High pressure blowout preventer system

ABSTRACT

A blowout preventer system including a lower blowout preventer stack comprising a number of hydraulic components, and a lower marine riser package comprising a first control pod and a second control pod adapted to provide, during use, redundant control of hydraulic components of the lower blowout preventer stack where the first and the second control pods are adapted to being connected, during use, to a surface control system and to be controlled, during use, by the surface control system. The blowout preventer system further including at least one additional control pod connected to at least one additional surface control system and to be controlled, during use, by the additional surface control system.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.17/134,950, which was filed on Dec. 28, 2020, which is a continuation ofU.S. patent application Ser. No. 15/706,360, which was filed on Sep. 15,2017, now U.S. Pat. No. 10,876,369, which is a continuation-in-part ofU.S. patent application Ser. No. 14/870,249, which was filed on Sep. 30,2015, now U.S. Pat. No. 9,803,448, which claims priority to U.S.Provisional Patent Appln. No. 62/057,586, which was filed on Sep. 30,2014, and U.S. Provisional Patent Appln. No. 62/067,829, which was filedon Oct. 23, 2014, the full disclosures of which are hereby incorporatedherein by reference in their entirety.

This application is a continuation of U.S. patent application Ser. No.17/134,950, which was filed on Dec. 28, 2020, which is a continuation ofU.S. patent application Ser. No. 15/706,360, which was filed on Sep. 15,2017, now U.S. Pat. No. 10,876,369, which is a continuation-in-part ofU.S. patent application Ser. No. 14/884,563, which was filed on Oct. 15,2015, now U.S. Pat. No. 10,048,673, and which claims priority to U.S.Provisional Patent Appln. Nos. 62/065,431, which was filed on Oct. 17,2014, 62/067,829, which was filed on Oct. 23, 2014, 62/078,236, filedNov. 11, 2014, 62/091,160, filed Dec. 12, 2014, 62/092,973, filed Dec.17, 2014, 62/093,051, filed Dec. 17, 2014, 62/093,083, filed Dec. 17,2014, 62/093,200, filed Dec. 17, 2014, 62/093,029, filed Dec. 17, 2014,62/097,845, filed Dec. 30, 2014, 62/103,817, filed Jan. 15, 2015,62/105,445, filed Jan. 20, 2015, 62/105,379, filed Jan. 20, 2015,62/147,210, filed Apr. 14, 2015, 62/155,671, filed May 1, 2015,62/158,364, filed May 7, 2015, and 62/164,086, filed May 20, 2015, thefull disclosures of which are hereby incorporated herein by reference intheir entirety.

This application is a continuation of U.S. patent application Ser. No.17/134,950, which was filed on Dec. 28, 2020, which is a continuation ofU.S. patent application Ser. No. 15/706,360, which was filed on Sep. 15,2017, now U.S. Pat. No. 10,876,369, which is a continuation-in-part ofU.S. patent application Ser. No. 15/160,073, which was filed on May 20,2016, now U.S. Pat. No. 10,012,049, and which claims priority to U.S.Provisional Patent Appln. No. 62/164,086, which was filed on May 20,2015, the full disclosures of which are hereby incorporated herein byreference in their entirety.

BACKGROUND OF THE INVENTION 1. Field of the Invention

Embodiments disclosed herein relate generally to subsea oil and gasdrilling systems. In particular, embodiments disclosed herein arerelated to subsea oil and gas drilling systems in high pressureenvironments.

2. Brief Description of Related Art

Subsea drilling for oil and gas typically involves the use of a vessel,which can be, for example, a drill ship or a platform, on the surface ofthe sea, with a riser extending to near the sea floor. The bottom end ofthe riser is attached to a lower marine riser package, which contains,among other things, control pods intended to control components of thedrilling system near the sea floor. Below the riser is typicallypositioned a stack, which includes a lower marine riser package and alower stack. The lower stack includes a blowout preventer (BOP) mountedto a wellhead. The drilling pipe extends from the vessel at the seasurface, through the riser to the bottom of the sea, through the BOP,and through the wellhead into a wellbore to the oil producing formation.

As subsea drilling extends into deeper formations, pressures andtemperatures increase. With higher pressures, there are greaterpotential safety and environmental consequences if a well leaks. Fordecades, limitations of known drilling technology have prevented the oiland gas industry from drilling wells having pressures greater thanapproximately 15,000 pounds per square inch, resulting in lost benefitsto the countries who own the associated oil reserves, the oil and gasindustry, and consumers.

In addition, Subsea drilling for oil and gas typically involves the useof a vessel, which can be, for example, a drill ship or a platform, onthe surface of the sea, with a riser extending to near the sea floor.The bottom end of the riser is attached to a lower marine riser package,which contains, among other things, control pods intended to controlcomponents of the drilling system near the sea floor. Below the riser istypically positioned a lower stack, which includes a blowout preventer(BOP) mounted to a wellhead. The drilling pipe extends from the vesselat the sea surface, through the riser to the bottom of the sea, throughthe BOP, and through the wellhead into a wellbore to the oil producingformation.

One purpose of the BOP is to act as a failsafe mechanism to prevent oiland gas from escaping from the wellbore into the environment. Toaccomplish this task, the BOP typically includes a plurality of rams.Some rams have elastomeric seals and are designed to close around thedrill pipe if needed to seal the annulus around the pipe. That way, ifan unexpected pressure surge tries to force oil and gas from thewellbore through the annulus, the BOP can close to prevent a spill.Other rams are known as shearing rams, including blind shear rams, andare designed to cut through drill pipe and other items extending intothe wellbore to completely seal the wellbore from the surroundingenvironment.

Because of the safety functions played by the BOP in a subsea drillingoperation, it is necessary to ensure that all BOP control systems andcomponents are functioning properly, and to provide redundant backupsystems in case of a failure. Accordingly, added redundancy andmonitoring capability, such as in the form of a safety instrumentedsystem, is beneficial.

In addition, as subsea drilling extends into deeper waters, pressures atthe sea floor, where the BOP is located, increase. With higherpressures, there are greater consequences if a well leaks, and the BOPsthemselves require design modifications to ensure safety. Accordingly,new safety instrumented systems for backing up the BOP control system,as well monitoring its function, are needed.

Furthermore, BOP systems are hydraulic systems used to prevent blowoutsfrom subsea oil and gas wells. BOP equipment typically includes a set oftwo or more redundant control systems with separate hydraulic pathwaysto operate a specified BOP function. The redundant control systems arecommonly referred to as blue and yellow control pods. In known systems,a communications and power cable sends information and electrical powerto an actuator with a specific address. The actuator in turn moves ahydraulic valve, thereby opening fluid to a series of othervalves/piping to control a portion of the BOP.

Many BOP systems are required to be safety integrity level (SIL)compliant. In addition, most modern BOP systems are expected to remainsubsea for up to 12 months at a time. In order to decrease theprobability of failure on demand, BOP control valves need to be testedwhile they are subsea without requiring extra opening and closing cyclesof the BOP or requiring additional high pressure hydraulic cycles toclose the bonnets solely for testing purposes. Various types of controlsystems can be safety rated against a family of different standards.These standards may be, for example, IEC61511 or IEC61508. Safetystandards typically rate the effectiveness of a system by using a safetyintegrity level. The SIL level of a system defines how much improvementin the probability to perform on demand the system exhibits over asimilar control system without the SIL rated functions. For example, asystem rated as SIL 2 would improve the probability to perform on demandover a basic system by a factor of greater than or equal to 100 timesand less than 1000 times.

One issue with attaining a safety integrity level rating for subseahydraulic equipment is lack of ability to test each valve in the systemand ascertain its functionality without retrieving the valve from thesea floor. BOP systems often utilize several valves working together toactivate a function in a single circuit. While some have suggestedplacing diagnostics on each and every valve in a BOP system, such asolution is impractical and difficult to execute in practice.

SUMMARY OF THE INVENTION

One aspect of the present technology provides a blowout preventer (BOP)system for use in a high pressure subsea environment. The BOP systemincludes a BOP stack including a lower marine riser package and a lowerstack portion, the lower stack portion having a plurality of BOP ramsattached to a subsea wellhead, and a riser subsystem extending from adrilling vessel to the BOP stack and providing fluid communicationtherebetween. In addition, the BOP system includes a ship boardsubsystem electronically, mechanically, and hydraulically connected tothe BOP stack and the riser subsystem to control the functions of theBOP stack and the riser subsystem, as well as a safety instrumentedsystem having a surface logic solver and at least one subsea logicsolver, the safety instrumented system in communication with at least aportion of the BOP rams to act as a redundant control system in case offailure of the ship board subsystem.

An alternate aspect of the present technology provides a BOP system foruse in a high pressure subsea environment that includes a BOP stackconnected to a drilling vessel, the BOP stack including a lower marineriser package and a lower stack portion, the lower stack portion havinga plurality of BOP rams attached to a subsea wellhead. In addition, theBOP system includes an auxiliary stack test system for connection to theBOP stack to test the BOP stack prior to deployment in order to ensurecompliance of the BOP stack with predetermined standards, the auxiliarystack test system having testing hardware and software designed to mimiccontrol system software and hardware to be used during drillingoperations in order to effectively test the BOP stack, the auxiliarystack test system comprising a safety integrity level rated systemcabinet configured to test a safety instrumented system of the BOPsystem.

An alternate aspect of the present technology provides a blowoutpreventer (BOP) system for use in a high pressure subsea environmentthat includes a BOP stack including a lower marine riser package and alower stack portion, the lower stack portion having a plurality of BOPrams attachable to a subsea wellhead, and a ship board subsystemelectronically, mechanically, and hydraulically connectable to the BOPstack and a riser subsystem to control the functions of the BOP stackand the riser subsystem, wherein the riser subsystem extends from thedrilling vessel to the BOP stack and provides fluid communicationtherebetween, the BOP system operable with a well having a pressure ofup to at least approximately 20,000 pounds per square inch.

An alternate aspect of the present technology provides a blowoutpreventer (BOP) system for use in a high pressure subsea environmentthat includes a BOP stack including a lower marine riser package and alower stack portion, the lower stack portion having a plurality of BOPrams attachable to a subsea wellhead, and a ship board subsystemelectronically, mechanically, and hydraulically connectable to the BOPstack and a riser subsystem to control the functions of the BOP stackand the riser subsystem, wherein the riser subsystem extends from thedrilling vessel to the BOP stack and provides fluid communicationtherebetween, the BOP system operable at internal fluid temperatures(i.e. fluids exiting the well and entering the BOP) of up to at leastapproximately 350 degrees Fahrenheit.

Yet another aspect of the present technology provides a method ofdrilling for oil and gas in a high pressure subsea environment. Themethod includes the steps of attaching a BOP stack to a wellhead at thesea floor, the wellhead capping a well having a pressure of up to atleast approximately 20,000 pounds per square inch, and connecting theBOP stack to a drill ship using a subsea riser subsystem. The methodfurther includes controlling functions of the BOP stack with a shipboard subsystem that is electronically, mechanically, and hydraulicallyconnected to components of the BOP stack, and connecting logic solversassociated with a safety instrumented system, and separate from the shipboard subsystem, to components of the BOP stack to act as a redundantcontrol system for the BOP stack.

One aspect of the present invention provides a control system for asubsea blowout preventer (BOP) positioned in a lower stack, the lowerstack releasably engaged with a lower marine riser package (LMRP). Thecontrol system includes a surface logic solver positioned at or adjacentthe surface of the sea that generates commands for operating the subseaBOP, a first subsea logic solver attached to the LMRP and incommunication with the surface logic solver so that the first subsealogic solver receives the commands from the surface logic solver, and asecond subsea logic solver attached to a hydraulic control unit in thelower stack. The second subsea logic solver is in hydrauliccommunication with the subsea BOP, and the first subsea logic solver sothat the second subsea logic solver receives the commands from the firstsubsea logic solver and implements the commands by activating thehydraulic control unit to operate the BOP.

In some embodiments, the lower stack can be attached to the LMRP by ahydraulic connector, and the hydraulic control unit can control thehydraulic connector. In other embodiments, the lower stack can beattached to the LMRP by a hydraulic connector, and the hydraulicconnector can be powered by an accumulator.

In certain embodiments, the surface logic solver, the first subsea logicsolver, and the second subsea logic solver, can each comprise a centralprocessing unit (CPU). In other embodiments, the surface logic solvercan comprise a central processing unit (CPU), and the first subsea logicsolver or the second subsea logic solver, or both, can comprise anextended input/output (I/O) card.

In some embodiments, the surface logic solver can be connected to thefirst subsea logic solver by a cable having high voltage wires andoptical communication lines, and the first subsea logic solver can beconnected to the second subsea logic solver by a cable having lowvoltage wires and no optical communication lines. In addition, thesystem can further include an acoustic pod in communication with andcontrollable by the second subsea logic solver.

In alternate embodiments, the system can further include a human machineinterface panel connected to the surface logic solver, and an automaticcontroller in communication with the surface logic solver thatautomatically issues commands to the surface logic solver based onpredetermined conditions detected by the surface logic solver. In suchan embodiment, the system can also have a key switch having a firstposition and a second position, the first position opening communicationbetween the surface logic solver and the human machine interface panel,and the second position opening communication between the surface logicsolver and the automatic controller.

Another aspect of the present invention provides a redundant controlsystem for a subsea BOP positioned in a lower stack, the lower stackremovably engaged with an LMRP, and the LMRP having first and secondcontrol pods, each in hydraulic communication with the BOP to controlthe BOP. The system includes a surface logic solver positioned at oradjacent the surface of the sea that generates commands for operatingthe subsea BOP, and a first subsea logic solver attached to the firstcontrol pod and in communication with the surface logic solver, thefirst subsea logic solver in communication with the first control pod sothat the first subsea logic solver is capable of receiving commands fromthe surface logic solver and implementing the commands by activating thefirst control pod to operate the BOP. In addition, the system includes asecond subsea logic solver attached to the second control pod and incommunication with the surface logic solver, the second subsea logicsolver in communication with the second control pod so that the secondsubsea logic solver is capable of receiving commands from the surfacelogic solver and implementing the commands by activating the secondcontrol pod to operate the BOP.

In some embodiments, the lower stack can be attached to the LMRP by ahydraulic connector, and the hydraulic connector can be in communicationwith the first subsea logic controller and the second subsea logiccontroller. In other embodiments, the lower stack can be attached to theLMRP by a hydraulic connector, and the hydraulic connector can bepowered by an accumulator.

In certain embodiments, the surface logic solver, the first subsea logicsolver, and the second subsea logic solver, can each comprise a CPU. Inother embodiments, the surface logic solver can comprise a CPU, and thefirst subsea logic solver or the second subsea logic solver, or both,can comprise an extended I/O card. In addition, control system canfurther include an acoustic pod in communication with and controllableby the first subsea logic solver and the second subsea logic solver.

In alternate embodiments, the system can further include a human machineinterface panel connected to the surface logic solver, and an automaticcontroller in communication with the surface logic solver thatautomatically issues commands to the surface logic solver based onpredetermined conditions detected by the surface logic solver. In suchan embodiment, the system can also have a key switch having a firstposition and a second position, the first position opening communicationbetween the surface logic solver and the human machine interface panel,and the second position opening communication between the surface logicsolver and the automatic controller.

Yet another aspect of the present technology provides a method forcontrolling a subsea blowout preventer (BOP). The method includes thesteps of generating a command signal in a surface logic solver locatedat or adjacent the surface of the sea, transmitting the command signalto a first subsea logic solver attached to a lower marine riser package,transmitting the command signal to a second subsea logic solver attachedto a hydraulic control unit in a lower stack, the hydraulic control unitin communication with the subsea BOP, operating the subsea BOP with thehydraulic control unit in accordance with the command signal.

In some embodiments, the first transmitting step between the surfacelogic solver and the first subsea logic solver can be carried out via anoptical cable between the surface logic solver and the first subsealogic solver. Similarly, the second transmitting step between the firstlogic solver and the second logic solver can be is carried out via acopper wire between the first subsea logic solver and the second subsealogic solver. In some embodiments, the first subsea logic solver canconvert the command signal from an optical signal to a copper signal.

Embodiments of the invention utilize back pressure and a reduced numberof sensors to carry out a proof test in a BOP system. Therefore,disclosed is a blowout preventer (BOP) safety system for testing theintegrity of hydraulic safety valves at the sea floor. The systemincludes a BOP stack including a BOP, the BOP comprising a BOP shearram; a first hydraulic circuit, the first hydraulic circuit in fluidcommunication with the BOP shear ram and having an open side and a closeside; and a manifold, wherein the manifold is disposed proximate to andin fluid communication with a dump valve, a first sensor, and a supplyvalve. The system further includes a first safety valve disposed betweenand in fluid communication with the manifold and the BOP on the closeside, wherein the dump valve is operable to allow flow from the BOP tothe manifold through the safety valve, and wherein the first sensor isoperable to detect the flow from the BOP to the manifold.

Additionally disclosed is a method for testing the integrity of safetyvalves on a blowout preventer (BOP) at the sea floor. The methodincludes the steps of pressurizing a manifold to increase pressure inthe manifold; detecting a first pressure increase in the manifold;decreasing the pressure in the manifold to less than the pressure in aBOP bonnet fluidly coupled to the manifold; opening a valve disposedbetween the BOP bonnet fluidly coupled to the manifold and the manifoldto allow flow from the BOP bonnet to the manifold; detecting a secondpressure increase in the manifold; closing the valve; re-pressurizingthe manifold; and presenting a pass or fail test message for theintegrity of the valve.

Further disclosed is a BOP safety characterization system to enhancesafety and reliability testing of BOP's in a subsea application. Thesystem includes a BOP stack, in electrical communication with a surfacecomputing unit and a processing unit disposed within the surfacecomputing unit, including a processor, operable to receive an electricalsignal from the BOP stack. The processing unit is in communication withand includes non-transitory, tangible memory medium in communicationwith the processor having a set of stored instructions, the set ofstored instructions being executable by the processor and including thesteps of: performing pressure testing on the BOP stack and maintainingpressure in one or more BOP's of the BOP stack; pressurizing a manifold;detecting a first pressure increase in the manifold; releasing pressurein the manifold via a valve to de-pressurize the manifold to aboutatmospheric pressure responsive to detecting the first pressure increasein the manifold; allowing fluid flow between one or more BOP's of theBOP stack and the manifold; detecting a second pressure increase in themanifold; and displaying a test pass or test fail message to a displayreadable by a user responsive to detecting the first and second pressureincreases in the manifold.

One alternate aspect of the present technology provides a blowoutpreventer system including a lower blowout preventer stack comprising anumber of hydraulic components, and a lower marine riser packagecomprising a first control pod and a second control pod adapted toprovide, during use, redundant control of hydraulic components of thelower blowout preventer stack where the first and the second controlpods are adapted to being connected, during use, to a surface controlsystem and to be controlled, during use, by the surface control system.The blowout preventer system further includes at least one additionalcontrol pod connected to at least one additional surface control systemand to be controlled, during use, by the additional surface controlsystem.

Another aspect of the present technology provides a lower blowoutpreventer stack comprising a number of hydraulic components, and atleast one additional control pod adapted to be connected, during use, toan additional surface control system. Some embodiments provide anadditional control pod arranged to receive information of one or moreinput signals provided to a first and/or a second control pod, and tomonitor whether an action is executed and completed by the first and/orsecond control pod and/or a lower blowout preventer stack and/or a lowermarine riser package.

Yet another embodiment of the present technology provides a blowoutpreventer system wherein the units, systems, and/or functionalityrelated to an additional subsea control unit and/or an additionalsurface control system, including the additional subsea control unitand/or the additional surface control system, is/are certified accordingto a predetermined safety requirement, rating, or standard, e.g.according to a safety integrity level rating or standard.

BRIEF DESCRIPTION OF THE DRAWINGS

The present technology can be better understood on reading the followingdetailed description of nonlimiting embodiments thereof, and onexamining the accompanying drawings, in which:

FIG. 1 shows a context diagram of a BOP system according to anembodiment of the present technology;

FIGS. 2A and 2B show a product breakdown structure diagram of the BOPsystem of the present technology, along with various subsystems;

FIG. 3A shows a diagram of the power distribution system;

FIG. 3B shows a context diagram of the ship board subsystem according toan embodiment of the present technology;

FIG. 4 shows a context diagram of the riser subsystem according to anembodiment of the present technology;

FIG. 5 shows a context diagram of the BOP stack according to anembodiment of the present technology;

FIG. 6 is a context diagram of the Lower Marine Riser Package (LMRP) ofthe BOP stack of FIG. 5;

FIG. 7A is a context diagram of the lower stack of the BOP stack of FIG.5;

FIG. 7B is a context diagram of the lower subsea control module of thelower stack of FIG. 7A;

FIG. 8A is a side schematic view of a safety instrumented system (SIS)according to an embodiment of the present technology;

FIG. 8B is a side schematic view of an SIS according to an alternateembodiment of the present technology;

FIG. 8C is a control system, including automatic and man-in-the loopcontrols, for the SIS of FIGS. 8A and 8B;

FIG. 9 is a context diagram of the umbilical subsystem according to anembodiment of the present technology;

FIG. 10 is a context diagram of the auxiliary stack test subsystemaccording to an embodiment of the present technology;

FIG. 11 is a context diagram of the data management subsystem accordingto an embodiment of the present technology;

FIG. 12 shows a side schematic view of a safety instrumented systemaccording to an embodiment of the present technology;

FIG. 13 shows a side schematic view of a safety instrumented systemaccording to an alternate embodiment of the present technology;

FIG. 14 shows a control system, including automatic and man-in-the loopcontrols, for the safety instrumented system of embodiments of thepresent technology;

FIG. 15 is a schematic of a BOP hydraulic drive circuit with uniquelyplaced safety valves and manifolds;

FIG. 16 is a schematic of the BOP hydraulic drive circuit of FIG. 1including proof test sensors; and

FIG. 17 is a sequence diagram for proof testing in an example method,optionally carried out on the BOP hydraulic drive circuit of FIGS. 1-2.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

The foregoing aspects, features, and advantages of the presenttechnology can be further appreciated when considered with reference tothe following description of preferred embodiments and accompanyingdrawings, wherein like reference numerals represent like elements. Thefollowing is directed to various exemplary embodiments of thedisclosure. The embodiments disclosed should not be interpreted, orotherwise used, as limiting the scope of the disclosure, including theclaims. In addition, those having ordinary skill in the art canappreciate that the following description has broad application, and thediscussion of any embodiment is meant only to be exemplary of thatembodiment, and not intended to suggest that the scope of thedisclosure, including the claims, is limited to that embodiment.

High Pressure Blowout Preventer System

The below description provides an overview of the systems of the presenttechnology. In it, the subsystems included in the technology identified,and a high level description of each subsystem is provided. Thisdescription also describes system level interfaces between thesubsystems, and external components required for proper BOPfunctionality within the system.

In the application, the acronyms and abbreviations used to describe thepresent technology can have the following meanings:

-   -   ASTS—Auxiliary Stack Test System    -   BPCS—Basic Process Control System    -   BOP—Blowout Preventer    -   BSR—Blind Shear Ram    -   C&K—Choke and Kill    -   CBM—Condition Based Maintenance    -   CCU—Central Control Unit    -   CP—Cathodic Protection    -   CSR—Casing Shear RAM    -   EDS—Emergency Disconnect Sequence    -   ERA—Electronic Riser Angle    -   FITA—Field Installable Termination Assembly    -   FRU—Fluid Reservoir Unit    -   HMI—Human Machine Interface    -   HPHT—High Pressure High Temperature    -   HPTU—High Pressure Test Unit    -   HPU—Hydraulic Power Unit    -   HVR—Variable ram    -   I/O—Input/Output    -   Ksi—Thousands of pounds per square inch    -   LMRP—Lower Marine Riser Package    -   MTBR—Mean Time Between Repairs    -   MUX—Multiplex    -   MWP—Maximum Working Pressure    -   psia_pounds per square inch absolute    -   RBOP—Ram Blowout Preventer    -   ROV—Remotely Operated Vehicle    -   SEM—Subsea Electronics Module    -   SIF—Safety Instrumented Function    -   SIL—Safety Integrity Level    -   SIS—Safety Instrumented System    -   SRS—Safety Requirements Specification

In the application, the following terms have the following definitions:

-   -   Central Control Unit means cabinets that contain the computers        which process the data and send control signals to other        subsystems such as the subsea POD. The CCU typically have a Blue        and Yellow designated cabinet for redundancy purposes.    -   Drillers Panel means the HMI terminal that is located near the        moon pool on a drillship.    -   Emergency Disconnect Sequence means a programmed sequence of        events that operates the functions to leave the stack and        controls in a desired state and disconnect the LMRP from the        lower stack.    -   Engineering Work Station means the HMI terminal to view BOP        status information. The Engineering Work Station typically        contains equipment for data logging.    -   Fluid Reservoir Unit mixes and stores hydraulic fluid        concentrate, glycol and water to produce the hydraulic fluid        which is supplied to the HPU for charging accumulator racks and        operating hydraulic stack functions.    -   Hydraulic Pumping Unit supplies hydraulic fluid to charge both        the surface and subsea accumulators from precharge pressure to        the maximum system operating pressure.    -   Kick means an influx of formation liquids or gas into the        wellbore. Without corrective measures, a kick can result in a        blowout.    -   Lower Marine Riser Package means the portion of the stack where        the annular BOPs and the subsea control system (POD) is mounted.        The LMRP may disconnect from the lower stack via a hydraulic        connector.    -   Lower Stack means the portion of the stack that sits between the        wellhead and the LMRP. Typically this portion of the stack        houses the ram BOPs, acoustic backup, and deadman systems.    -   POD means the subsea component that contains two SEMs, the        subsea transformer, and the subsea hydraulic control valves.    -   Safety Integrity Level refers to the amount of risk reduction        required from the safety instrumented system.    -   Safety Instrumented System is a system engineered to perform        specific control functions to failsafe or maintain safe        operation of a process when unacceptable or dangerous conditions        occur.    -   Skid refers to the mechanical arrangement for certain subsystems        on the ship.    -   Stack means the assembly that sits between the wellhead and the        riser. The blowout prevention system is mounted to the stack.        The stack consists of the lower stack and the LMRP.    -   Toolpusher's Panel means an HMI terminal located on the        drillship.

During drilling operations, the BOP is typically the secondary method ofwell control. The primary method of pressure control in a well generallyconsists of pressure control via weighted drilling mud using counterpressure techniques. Due to the uncertainty of reservoir pressures,however, which are estimated prior to commencing drilling, at times theweight of the drilling mud is insufficient to maintain control of thewell. In such a condition, known in the industry as a kick, the BOP canprotect the rig and the environment from the effects of the kick.

In the drawings, FIG. 1 depicts the top level subsystems. These includeship board subsystems 300, marine riser subsystems 400, BOP stacksubsystem 500, including LMRP 600 (shown in FIG. 6) and lower stack 700(shown in FIG. 7), SIS subsystem 800, umbilical subsystem 900, testsuite 1000, and big data subsystem 1100 (rig to cloud data managementsubsystem). In addition, some embodiments of the present technologyinclude CBM technology, through which systems of the technology collect,correlate, and process data related to specific components or groups ofcomponents, and determine a use-based maintenance schedule moreefficient than known time-based maintenance schedules.

As described in further detail below with respect to each subsystem, theshipboard subsystems 300 can include surface controls, a diverter skidand accumulator (designed to support the hydraulic needs of a diverter),an HPU and/or FRU and accumulator (designed to support the hydraulicneeds of the HPU), power management components, as well as othercomponents. The marine riser subsystem 400 can include an LMRP riseradapter, riser joints, riser tension rings, riser running tools (whichcan be hydraulic), manual running tools, and riser lifting tools. Themarine riser subsystem can also include an automated riser managementcontrol system (RMS) capable of using radio frequency identification(RFID) techniques for each riser section to uniquely identify thatsection for the purpose of tracking is deployment (time subsea) andposition in the riser string.

In addition, and as can be described in further detail below, the BOPstack subsystem 500 can include subsea controls and acoustic sensinghoused within the stack frame. In some embodiments, the stack canaccommodate the ability to be lifted vertically or horizontally from theocean floor, and the frame surrounding and supporting the BOPs canprovide the ability to mount acoustic sensors and the electroniccontrols to collect the data for transmission to the surface. The BOPstack subsystem 500 can also be equipped with a C&K subsystem, and canbe designed to be ROV friendly by providing panels to allow an ROV theability to read and/or collect data and actuate valves as a means ofindependent external control of certain functions.

The SIS subsystem 600 can include a surface and subsea logic solver, aswell as SIL rated hydraulic components to actuate the identified BOPsper SRS. The test suite 1000 can include an ASTS for conducting testingof an auxiliary stack on the deck of the ship, as well as an HPTU fortesting the hydraulics on the riser string and BOP stack. Furthermore,the test suite 1000 can include a POD test station. In some embodiments,the big data subsystem 1100 can include two distinct levels offunctionality. First, portions of the big data subsystem 1100 can resideon the drill ship in the form of a server providing a framework forhosting applications to meet customer needs and provide a portal fortransmitting data to a cloud based data management system. Second, thebig data subsystem 1100 can utilize cloud based data management servicesto provide operational data, such as component tracking.

According to certain embodiments of the technology, the top levelfunctionality of the drilling system can include a BOP stack subsystem500 designed to address 20 Ksi pressure ratings needed for exploringwell depths not currently achieved using existing technology. Inaddition, the marine riser subsystem 400 can provide a connectionbetween the surface drill ship and the BOP stack subsystem 400components for the drilling equipment to be guided to the wellhead, andsupport the cabling and hydraulics for controls between surface andsubsea subsystems.

In addition, in some embodiments, the BOP control system (surface &subsea) can allow a drilling operator the ability monitor and actuatethe BOP stack subsystem 500 functionality. The umbilical subsystem 900can provide high voltage power, hydraulic lines, and fiber opticcommunication cables. In addition, the umbilical subsystem 900 can beredundant with a Blue and Yellow designation that corresponds to commonterminology in the field.

Furthermore, in some embodiments, the system can include new features toallow external monitoring of the BOP stack subsystem 500 usingacoustics, and can also include an SIL rated backup control system toprovide enhanced safety. To improve tracking of parts and enhance theability to identify potential risk, a big data subsystem 1100 can beused. The big data subsystem 1100 can allow tracking of usage to ensurecustomer service is aware of pending equipment service and failurepatterns. This system can identification of patterns to aid inaddressing systemic design issues.

In some embodiments of the technology, the system can monitor thefollowing conditions, among others:

-   -   FRU fluid levels (high and low)    -   Temperatures within surface control cabinets    -   Temperatures within the subsea SEM housing, power bus voltage        (both AC and DC)    -   Solenoid voltage and current (e.g., a small trickle current can        be monitored to indicate the solenoid coil isn't open circuit)    -   Water ingress in the SEM housing (An alarm message can be sent        to the surface if the housing loses the 1 ATM pressure and water        begins to fill the housing)    -   Well bore pressure & temperature    -   Surface accumulator pressure    -   Subsea manifold regulator pressure    -   Upper and lower annular regulator pressure    -   HPU Accumulator, Manifold and pump pressures and filtration        (which can provide an indication that a filter is plugged)    -   Hydraulic flow to subsea components    -   ERAs on both ends of the riser    -   BOP Ram position and pressure    -   Hydraulic leaks and valve actuations in an acoustic detection        subsystem.

At least a portion of these conditions can be monitored using pressureand temperature sensors that conform to an electrical interface in therange of about 4 to about 20 milliamps (mA).

Certain embodiments of the present technology can also include up tofive or more SIFs. These can include: pipe ram BOP control, CSR BOPcontrol, BSR BOP control, LMRP connector release, and EDS.

The systems of the present technology are advantageous over many knownsystems because they provide a number of different capabilities. Forexample, the system described herein is reliable, and can have an MTBR(scheduled or unscheduled) of up to about 365 BOP-days or more for thesystem of all subsea equipment. This is achieved in part by improvingreliability by about 120% or more in some subsystems, including theumbilical subsystem 900, subsea electronic components, subsea hydrauliccomponents, and C&K lines. Reliability improvements to other componentsare beneficial for improving MTBR. Further, the systems and subsystemsof the present technology are designed to comply with applicablegovernment and industry regulations and standards, such as thoseassociated with the Bureau of Safety and Environmental Enforcement(BSEE), and American Petroleum Institute (API), and the InternationalElectrotechnical Commission (IEC).

In addition, systems of the present technology are capable of achievinghigh levels of drilling availability for each function of the system,and to reduce running time and the time taken for maintenance. This isaccomplished by implementing redundancy in strategic portions of thesystem, as described in further detail below. Furthermore, the systemsof the present technology are designed so that the system designmaintenance interval can be about 10 years or more.

Overall System Architecture—FIGS. 2A and 2B

The BOP system 10 comprises numerous subsystems as identified in FIGS.2A and 2B. For example, the BOP system 10 can consist of a risercomponents 12, multiple ram type BOPs 14, annular BOPs 602 (shown inFIG. 6), C&K components 16, a control system 18, and a subsea SIL solverwith SIL rated valves. The BOP system 10 can be connected to the surfacethrough a riser, two umbilical cables (containing fiber & copper), tworigid conduits, and a hot line. Subsea blue and yellow redundant podsare cross connected using a FITA device to provide redundant paths forcommunications & power. The BOP system 10 can contain electrical andhydraulic controls sufficient to close any of the ram BOPs or theannular BOPs on-demand. The BOP system 10 also includes mechanicalcomponents 20, condition monitoring components 22, and test components24.

The riser components 12 provide the primary conduit between the surfaceand the wellhead equipment for drilling mud and drilled matter.Additionally, the riser components 12 support the weight of the BOP andLMRP during deployment and retrieval of these components, and can have atension rating of up to about 4.5 million lbs. or more. The risercomponents 12 extend from the LMRP up to a diverter, and consist of thefollowing: a riser 26, riser adapter 28, riser joints 30 (which can beslick and buoyant, and can be about 90 inches in length), various pupjoints, C&K lines, a boost line, hydraulic lines (which can be duplex),a gas handler with a gas diversion line, telescopic joint interfacing,telescopic rings 32, a split tension ring, a termination ring, a spider34, and a gimbal 36, as well as various running, handling, andmaintenance tools.

In certain embodiments, the riser main tube can have a minimum insidediameter of about 19.25 inches below the telescopic joints. In addition,in many embodiments, the riser connection coupling make-up anddisconnect does not require manual interface and can be completelyautomated for running and retrieval.

The ram type BOPs 14 can consist of one dual annular and a flex joint(which can have up to about a 6,000 lb. rating) at the top of the stackand supported by the LMRP frame. In some embodiments, there can be abouteight ram type BOPs 14, which can comprise the BOP stack on the lowerframe. The rams can include two or more BSRs 38, one or more CSR 40, andat least one pipe ram 42. In some cases, there may also be included anHVR 44.

The C&K components 16 are designed to allow a driller to circulate out akick that is contained in the wellbore by a closed BOP. Once a kick hasbeen detected, the mud weight must be increased to prevent furtherinflux into the wellbore. At the same time, any influx of gas already inthe well must be safely circulated out. A choke line 48 directs fluidout of the wellbore to what is known as a choke and kill manifold,located on the surface of the drilling vessel. There can be a variablechoke valve on the surface that is controlled to maintain a safecirculation of any influx out of the well. A kill line 50 is usedcirculate fluid into the wellbore below a closed BOP. Using the killline 50, a driller can add higher weight mud into the wellbore to stopany further influx from occurring.

Each cavity in the BOP can have an outlet for attaching either a chokeline 48 or a kill line 50, depending on the BOP stack configuration,below the closed ram for that cavity. These choke lines 48 and killlines 50 are isolated from the wellbore using what are known in theindustry as C&K valves 52, 54, respectively. The C&K valves 52, 54 canbe assembled on the BOP stack 14 and used to isolate the wellbore fromthe C&K lines 48, 50 during normal operations. In a kick scenario, twoof these valves can be opened to allow flow into and out of thewellbore. In some embodiment, the valves can be a 3 1/16″ bi-directionaldouble master C&K gate valves with a failsafe closed actuator and afailsafe open actuator. These valves are typically mounted to a 3 1/16″or 4 1/16″ flange. The actuator can be powered by the same controlsystem that controls the other functions on the BOP stack 14, utilizingthe same operating fluid.

On the BOP stack, the C&K components 16 also consist of C&K connectors56, 58, respectively, flexloop 60, and pipe spools 62. The C&Kconnectors 56, 58 are typically hydraulically extendable connectionsbetween the C&K lines 48, 50 on the LMRP and the lower stack. Since theLMRP is separately retrievable from the lower stack, a connector isrequired to enable the separation. The flexloop 60 provides a flexibleconduit for connecting the C&K lines 48, 50 from the top of the fixedBOP stack to the riser adapter, which is allowed to move. Because theBOP stack is anchored to the seafloor, but the vessel is free to move onthe surface, motion in the riser 26 must be allowed relative to the BOPstack 14. The flexloop 60 is used to allow this motion, which typicallyallows up to about 10 degrees of motion between the BOP stack 14 and theriser 26 in any direction. The flexloop 60 line is typically eitherrigid pipe bent into a loop or reinforced elastomeric hoses. The pipespools 62 can be straight tubular members with flanges on each end toconnect to the flexloop 60, C&K valves 52, 54, BOP stack 14, C&Kconnectors 56, 58, etc.

The control system 18 of the BOP system 10 can be broken into distinctpieces, including surface controls 64, surface hydraulic controls 66,subsea controls 68, subsea hydraulic controls 70, and umbilical controls72.

The surface controls 64 can include software 74, developed usingsoftware modeling tools specific to generate executables targeting theknown controllers and IO frameworks. The dual redundant CCUs (Blue &Yellow), discussed in greater detail below, are the focal point for thesystem control communication in the surface controls 64, and act as twoof several HMIs. All data, including function commands from any surfacecontrol HMI, the associated responses from targeted system components,and system status updates, pass to the CCU, which in turn directs thedata to the appropriate system components, as well as an engineeringworkstation for historical recordation.

The Engineering Work Station (EWS) (not shown) is the primary interfaceto the control systems 18 software. The cabinet mounted processor iscapable of monitoring and printing alarms, errors, and events generatedby the control system software as well as maintenance/diagnostics,system set up, and administrative capabilities.

The HPU interface panel (not shown) operates the hydraulic fluid mixingskid, controls up to three quintuplex pumps on the pumping skid,monitors surface accumulator and manifold pressures and controlselectric actuators, which operate the open/close functions for thesurface accumulator isolator valve, the blue and yellow hot line valves,and the rigid conduit valve.

The diverter control system interface panel (not shown) allows thediverter to be operated remotely from the CCU, driller's panel, ortoolpusher's panel, and allows for communication between the systemcontrollers and the diverter interface panel remote inputs and outputs.

The electrical distribution subsystem (not shown) includes redundant(Blue & Yellow) CCUs, and an uninterruptible power supplies (UPS) (notshown), a power distribution panels (PDPs) (not shown). The UPS isolatesfilters and regulates impure and erratic input power, as well asproduces a reliable, consistent, pure sine wave output. The UPS canprovide power to the control system 18 for a minimum of at least abouttwo hours if loss of input power occurs. The PDPs provide powerselectivity, protection, and coordination for the surface controls 64.Each PDP can receive power on two independent buses from two separateUPS sources, and can coordinate distribution to individual controlsub-systems.

Some embodiments of the present technology can include a SIS panel,which can be a surface based logic controller that provides safetysystem control communication to the control systems 18. The SIS panelcan have pushbutton functionality, and can provide illuminatedindication to the operator for SIS events. Data, including functionsafety commands to subsea components, can originate from this panel. Inaddition, the associated responses from targeted system components, andsystem status updates, can be passed back to this panel.

In some embodiments, the remote display panel (not shown) can serve asthe primary operator's station for the control systems 18. The remotedisplay panel can be rated for use in hazardous areas, and can consistof a touchscreen driven by a board computer therein. The remote displaypanel can serve as several HMI options for controlling the controlsystems 18.

The surface hydraulic controls 66 can be responsible for filtering,mixing, pressurizing, storing, and distributing the control fluid thatis used subsea and elsewhere on the rig for BOP operation and testing.The rig supplies potable water, concentrate, and glycol for use in thecontrol fluid. The potable water can pass through a series of filtrationand UV cleaning system components to bring the water to the concentratemanufacturer's recommended cleanliness prior to supplying the water toan FRU 76.

The FRU 76 mixes and stores hydraulic fluid concentrate, glycol, andwater to produce the hydraulic fluid the supplies an HPU 78. The mixratio of the fluid can be adjustable to match the manufacturer'srecommended mix ratio. The control fluid can be stored in anunpressurized tank that feeds the HPU 78.

The HPU 78 can supply hydraulic fluid to charge both surface and subseaaccumulators 80 from precharge pressure to a maximum system operatingpressure which, in some embodiments, can be about 5,000 psi. This storedfluid can be used to operate all hydraulic functions in the LMRP andlower BOP stack.

The accumulators 80 can be charged with BOP control fluid by the HPU 78from pre-charged pressure up to the system's operating pressure. Thecontrol fluid can then be discharged to the subsea hydraulic controls 66via the rigid conduits on the riser and/or the hotline of the umbilicalsubsystem.

The subsea controls 68 can include electronic/electric and hydrauliccontrols for the purpose of monitoring and controlling the BOP stack 14.The subsea controls 68 can provide a reliable means to control theactivation of the C&K valves and the BOPs (including rams and annulars),as well as other loads.

In addition, the subsea electronics can communicate with the surfacecontrols 64 via fiber optic cables. Using fiber to communicate allowshigher transmission rates required for the continuous monitoringsubsystem, as well as greater immunity to electromagnetic interference.Control communications can be made independent of non-criticalcommunications by routing the control communications through separatefibers.

The SEM and the subsea hydraulic controls can be major subsystems of thesubsea POD 82. The SEMs can provide the ability to collect and transmitdata (e.g., pressure, temperature, flow rate, and ram position) to thesurface control subsystem, as well as the electric actuation of pilotvalves through solenoids. There can be two fully redundant SEM unitswithin each POD 82. In addition, subsea hydraulic controls can includepilot valves, shuttle valves, lines, SPM valves, and accumulatorbottles. The accumulator bottles can provide the hydraulicfluid/pressure necessary to actuate a BOP.

The architecture of the subsea controls 68 can also include a newconcept of encapsulating the power and communications into a common hubto serve as a source decoupled from the SEMs. This embodiment can deployredundant hubs, including two on the LMRP and two the lower stack. Thisdesign can be advantageous because it can reduce (or eliminate) futureredesigns of the SEM POD 82 if the need arises for additional power orcommunications. The subsea controls 68 design can also incorporate thefunctionality and interfaces of the FITA to allow cross coupling of bothpower and communications between the two PODs.

In some embodiments, the subsea controls 68 design (as well as thesurface controls 64 design) can include an independent subsea logicsolver (and/or IO extension) as part of the overall SIS to provideadditional subsea safety controls.

The subsea hydraulic controls 70 are at least partially responsible forreceiving control fluid from the surface hydraulic controls 66, anddistributing that fluid to the hydraulic functions on the LMRP and LowerStack. The subsea hydraulic controls 70 can include a rigid conduitmanifold supplied with control fluid from rigid conduits 86 (blue andyellow) and/or the hotlines 88. Rigid conduit manifold regulators (notshown) can regulate (as necessary), and distribute the control fluid tothe appropriate pod and to the subsea accumulators 80. The rigid conduitmanifold 84 can be piped in such way that either rigid conduit 86 cansupply either pod with complete redundancy.

The hydraulic section of the subsea pod typically receives control fluidfrom the rigid conduit manifold 84, regulates the fluid to the properpressures, and distributes the fluid to the appropriate functions on theLMRP and Lower Stack. The pods can contain flow meters to measure flowas functions are actuated, as well as pressure transducers to measurethe pressures of selected functions and sources.

The subsea accumulators 80 can supply pressurized control fluid for thesubsea backup systems, e.g. autoshear/deadman, acoustic pod, ROVintervention, and SIL pod. These accumulators 80 can be suppliedpressure from the surface, or can be recharged with an ROV.

The subsea hydraulic controls 70 can contain a deadman/autoshear system(not shown). The deadman/autoshear system is designed to shut in thewell in the event that both pods lose all hydraulic supply andelectrical communications from the surface. The function of theautoshear is to shut in the well if there is an unplanned separation ofthe LMRP from the Lower Stack. The deadman/autoshear can close the CSRs40 and then the BSRs 38 after a delay. These systems are passive, canstay armed once they are armed, and can have read back showing theirarm/disarmed state at a given time.

The autoshear system (not shown) is a safety feature that canautomatically close one set of shear rams if hydraulic pressurecommunication between the pod and the receiver manifolds is interruptedwhen the system is in the armed state. Hydraulic pressure losses canoccur, for example, during unplanned LMRP disconnects or pod stabretractions.

The autoshear system can be made up of two hydraulic circuits, includingthe pod-mounted autoshear circuit, and the stack-mounted autoshearcircuit. The stack-mounted autoshear/deadman valve assembly can includea dual SPM valve, consisting of an arm/disarm valve and a trigger valve.The arm/disarm valve can be dual piloted, and have a pilot-operatedcheck valve (POCV) on the arm circuit pilot line to help maintain thevalve in the armed (OPEN) position. The valve can also have a so-called“stay put spool” that can make sure the valve stays in its last knownposition if the POCV were to fail. During normal operation, the triggervalve can be held closed with pilot pressure, and primarily uses springsto fail open upon loss of pilot pressure to close a shear ram in anautoshear/deadman event. This valve, however, has additional redundancy,and can also be designed to fail open in the event both valve springsare damaged. At the input port of each autoshear dual SPM valve, anorifice fitting can be installed to reduce water hammer effects on thesystem.

Embodiments of the present technology also allow the circuit to functionas a “deadman” circuit. If hydraulic pressure and electricalcommunication is interrupted to both pods, the pod-mounted autoshearcircuit can activate the stack-mounted autoshear valves. This can resultin the closure of the BSRs if the autoshear/deadman is armed. Inaddition, according to some embodiments, the acoustic pod backup systemcan consist of several critical functions that can be controlledremotely using an acoustic package.

In some alternate embodiments, the subsea hydraulic controls 70 canallow for ROV intervention, such as to control critical functions,isolate defined potential leak points, and/or provide visual read backs(e.g., via gauges, position indicators, etc.).

The umbilical controls 72 can provide the ability to deploy dual cables(Blue & Yellow designation) in a synchronized control. In addition, theUmbilical controls 72 can include synchronization of a hydraulic“Hotline” reel. The synchronized controls can allow for automateddeployment and retrieval of the umbilical.

The umbilical controls 72 can include controls for cable reels 90. Incertain embodiments, each cable reel 90 and frame can be fabricated fromcarbon steel, and coated with a three-coat protective coating system.The cable reels 90 can be painted in accordance with the Blue and Yellowdesignations to provide a visual connection to the subsea pod for whichthey are attached. The cable reels 90 can also include heavy-duty pillowblock bearings, an air motor and level wind drive system, a disc brakesystem, a slip-ring assembly and an interface junction box. Furthermore,the cable reels 90 can be equipped with drum mounted disc brake calipersthat are controlled from a reel control console 92. A housing can beincluded to cover the brake shoes and the stainless steel brake rotor,in order to provide protection from the elements in the environment.

In addition to the above, in some embodiments, a removable level windsystem can be included, and can be mounted to the front of the cablereel 90. It can be driven by the rotation of the cable reel 90. Thelevel wind assembly can consist of a stainless steel drive shaft(Archimedes screw) supported by flanged bearings, a manually actuatedover-ride clutch for synchronization of the level wind with the cableposition, and a traveling carriage. The traveling carriage can beequipped with resilient rollers that control the MUX cable 94 beingspooled out from the cable reel 90 and support structure. The travelingcarriage can also be self-reversing, and, once installed, can besynchronized with the point of exit/entry of the cable-to-reel drum.

Each reel 90 can be fitted with a heavy-duty slip-ring assembly that ismanufactured to explosion proof standards. The slip rings can be redbrass with two copper-graphite brushes per ring. Signal transfer throughthe slip rings can be via two contacts per slip ring, although operationand control can be maintained with only one contact working. Theslip-ring housing can be manufactured from stainless steel, and can beflange mounted into the main cable reel 90 shaft. In addition, the cablereel 90 can be equipped with an increased safety junction box for slipring-to-MUX cable termination. Furthermore, air controls can be housedin a stainless steel cabinet mounted on the cable reel 90 structure.This cabinet can contain air valves that drive the cable reel motor andthe disc brake system.

According to some embodiments of the present technology, the testcomponents 24 can use a UPS source. The UPS can be designed to providepower conditioning and a battery powered back-up supply in the event ofmain power supply failure (drill ship generators). The powerdistribution unit within the UPS cabinet can distribute power to thefollowing entities: 1) the ASTS 94 CCU cabinet, 2) remote displaypanels, 3) the pod test junction box, and 4) the HPTU 96.

According to some embodiments of the present technology, the ASTS 94provides the ability to test all functionality (both electronic &hydraulic) on an auxiliary BOP stack as it resides on the deck of thedrill ship. The ASTS 94 can issue commands and monitor all BOP functionsto test the spare stack before being deployed subsea. The ASTS 94 cantrack all usage of identified components (e.g., valves, rams, annulars)to provide the data required for monitor stack usage. The test operatorcan interface with the ASTS 94 through a multi-purpose HMI. The ASTS 94can have the ability to test the BOP stack with one or both subsea podsinstalled.

The hydraulic power for the test can be supplied by the same HPU 78 thatsupplies the BOP stack 14 during drilling operations. The HPU 78 andassociated fluid system can provide adequate barriers and flexibilitybetween the two BOPs (i.e., the test BOP and the BOPs in the stack) toensure that the primary system is compliant with all relevantregulations and specifications at all times.

In addition to testing the BPCS functionality, the ASTS 94 can alsoprovide testing of the subsea SIS functionality and defined interfacebetween the two subsystems. The logic solver to be used by the ASTS 94can be at least SIL level 1 capable.

The HPTU 96 can be designed to provide test pressure for the BOP, C&Klines 48, 50, boost line, and rigid conduits 86. The HPTU 96 can bedesigned to provide high-pressure injection of glycol. The HPTU 96 canalso include an HPTU skid, a computerized pump controller, a motorstarter panel, a BOP/test storage area remote panel, and a rig floorpanel. The system can be designed to be able to supply fluid in acontrolled, safe, and properly isolated manner.

In some embodiments, a pod tester 98 can be used with a laptop portablecomputer that is furnished with the system. The software in the podtester 98 can allow an operator to test and monitor any function, analogvalue point, or flow meter reading in the subsea pods of the BOP controlsystem 10 while on a test stand. The software can also monitor analogreference points in the monitored subsea pod. Each regulator may also beoperated by increase or decrease commands. The flow meter readings canbe displayed, and may be reset with screen buttons on the pod tester 98screen. In addition, a visual display screen can display the status ofeach solenoid, and can display the analog values for the analogreference points and flow meter readings. The software of the pod tester98 can: 1) monitor analog transducers, 2) monitor flow meters, 3)operate regulators, and 4) exercise individual solenoids.

Ship Board Subsystem—FIGS. 3A and 3B

Referring now to FIG. 3A, there is shown a context diagram of the shipboard subsystem 300, including surface electronic controls 302, a powermanagement subsystem 304, an HPU/FRU/Accumulator subsystem 306, and adiverter skid/accumulator subsystem 308. The details of each of thesecomponents is discussed in detail below.

The surface electronic controls 302 can include the following hardware(See, e.g., FIG. 3B):

-   -   A Blue and Yellow designated CCU cabinet    -   A Blue and Yellow designated IO cabinet    -   Four HMI panel consoles with a dual processor and dual LCD touch        screens    -   One drillers console HMI with a dual processor and an LCD touch        screen    -   One HPU I/O interface panel    -   One Diverter I/O interface panel    -   One EWS    -   A Safety Control Cabinet    -   One cabinet to function as a server rack (for big data and        servers)    -   A GPS subsystem with a 2 antenna configuration (2 antenna        configuration can provide a heading without movement)

In addition, Ethernet communications external to the cabinet can becarried out via fiber optic cable. Blue and Yellow power can be providedto the control cabinets, HMI panels, HPU interface panel and Diverterinterface panel. In some embodiments, the cabinets can have up to 20%spare capacity, and 20% extra space for future extension. Furthermore,in certain embodiments, the HPU interface panel can provide an interfacefor flow meter data, motor control, pressure switch reading (such as forsecondary motor control), FRU control, and isolation valve control.

The power management subsystem 304 is responsible for meeting the powerneeds of the BOP system. The power management subsystem 304 can acceptpower from the ship's generator power, convert the raw input into DCpower, and then convert the DC power back into AC power per voltagesrequired. The power management subsystem 304 can also provideuninterruptable power for a minimum of 2 hours. In addition, in someembodiments, the power management subsystem 304 can provide notificationto the surface electronic controls 302 when the batteries are not beingcharged, and/or when the batteries are being discharged. An example ofone possible configuration for the power distribution system, accordingto an embodiment of the invention, is shown in FIG. 3A.

Also depicted in FIG. 3A is the HPU/FRU/Accumulator subsystem 306. Asindicated by its name, the HPU/FRU/Accumulator subsystem 306 includes anHPU, an FRU, and BOP surface accumulators, and a water filtrationsystem, among other components. Each of these components is discussed ingreater detail herein.

According to some embodiments of the invention, the HPU stores hydraulicfluid, and supplies hydraulic fluid to charge both the surface andsubsea accumulators from a precharge pressure to a predetermined maximumsystem operating pressure. This stored fluid can be used to operate allhydraulic functions in the LMRP and Lower BOP stack.

The HPU can include an HPU interface panel that provides device controland data acquisition functions for the hydraulic power system. The HPUcan produce alarms that can be communicated to the surface controlsystem, for annunciation to the remote HMI panels and logging of alarms.

The main pumping unit of the HPU can be mounted on a heavy-dutyoilfield-type skid. In some embodiments, the skid frame can beconstructed of fully seam welded carbon steel coated with a paint systemsuitable for marine service applications. The skid can also include astainless steel drip pan with a drain valve. The exposed skid deck canbe equipped with fiberglass non-skid grating installed over a skid drippan. Stainless steel components can be passivated and/orelectropolished.

The pump skid unit can be equipped with a filtration system to providefluid to, for example, the control manifolds, diverter system, and BOPstack. The unit can contain dual, two-inch, micron stainless steelfilters with visual clogged filter indicators and internal bypassvalves. Further, the filter manifolds can be equipped with differentialgauges. The filter housings can use a manifold designed with shut-offisolation valves positioned upstream and downstream to allow isolationand service of an individual filter while maintaining operation of therest of the system. In addition, bypass equalization valves can beincluded on all filters and manual isolation valves to equalize pressurebefore returning to full flow.

In some embodiments, the pumps of the HPU can be electrically driven.The HPU can include up to three electric motors with redundant powersupplies (e.g. one can be supplied from the main switchboard and onefrom the emergency switchboard). Each motor can be coupled with plungertype pumps, and the electric motors can be 480 volt, 3-phase, sixty (60)Hz rated motors. Furthermore, each pump can be driven by multiple “V”belts, so that they require little or no oil bath, yet are able tomaintain minimal noise and vibration levels.

The pumps of the HPU can be mounted for ease of service maintenance, andcan include, but do not require, top loading, stainless steel suctionstrainers, relief valves, suction and discharge isolation valves, bleedvalves, and appropriately sized pulsation dampeners. In addition, the LPinlet filter to each pump can have a basket type strainer with aremovable mesh screen to support the required flow quality and flowrates for the particular drilling operation. In addition, in someembodiments, each pump can have an automatic reset relief valve on theoutput of the fluid end that is capable of a higher discharge rate thanthe pump.

The pumps used in the HPU can be independent and redundant in operationwith an alarm interface package, and can include the following: lowreservoir level alarms, low pressure alarms, automatic motor shut-off,and manual override to run pumps in emergency conditions.

With regard to motors that power the pumps in the HPU, some embodimentsof the present technology contemplate an automatic motor startersupplied for each motor. In addition, the HPU can be equipped with aflow meter, such as, for example, an externally mounted stainless steelultrasonic flow meter, to measure totalized flow in gallons. Thesubsystem and the flow meter can be designed to minimize the risk offlow meter turbine wash out (if applicable).

In some embodiments, the HPU can include surface system isolation valvesoperable to provide remote isolation of the following HPU functions: thesurface accumulator, isolator blue rigid conduit, a hot line isolator,and a yellow rigid conduit isolator. In addition, panel mounted, dualscale (psi/bar) pressure gauges with snubbing devices can be providedfor monitoring the supply pressure at function outputs. Furthermore, amanually operated diverter supply isolation valve with an inline checkvalve can be provided to supply hydraulic fluid to a diverter controlunit. A manually operated test suite isolation valve can also beprovided to supply hydraulic fluid to an ASTS/POD test area.

In some embodiments, the piping associated with the HPU can be of 316Lstainless steel, socket-weld construction utilizing bolt o-ring flanges.In addition, tubing can be made of annealed, seamless, 316L stainlesssteel with double ferrule-type connections.

According to some embodiments of the invention, the FRU can consist of aglycol tank, a concentrate fluid tank, and a mixed control fluid tank.The tanks can be made of stainless steel, and can have suitable accesshatches, breathers, drain plugs, and baffles installed, as well as amagnetic flag type sight glass. In some embodiments, the FRU can beassembled on a separate skid to be mounted next to the HPU. Thereservoir tank can be designed so that it cannot be emptied whilecharging the system from pre charge pressure to MWP.

According to certain embodiments, the mixing system can be automatic,and can mix the fluid for the BOP control system. The system can mix ata rate sufficient to supply the combined discharge flow rate of the HPUpumps. In addition, an emergency drill water fill up line with a manualisolation valve can be provided that bypasses the rig water directlyinto the mix tank. If sufficient rig water supply is available, the linesize can be large enough to supply the tank with all pumps running.Furthermore, in some embodiments, there can be a supply line from theglycol tank to the HPTU that can double as a glycol injection pump forthe choke manifold.

The FRU has four tanks as part of its fluid containment system,including 1) water, 2) glycol, 3) concentrate, and 4) mixed tank. Allfour tanks can be equipped with low level alarms which shut off thepumps feeding the mixed tank. In addition, the mixed tank can have a“mix empty” alarm that can shut off the HPU pumps. When the mixed tankfluid is again above the mix empty level, so that the alarm isde-energized, the HPU pumps can then automatically restart. This isadvantageous because it can reduce the chance of damage due to pumpcavitation. The alarms of the FRU can be visible in the driller's, CCUand “subsea workshop room” panels.

The FRU system can be mounted on a heavy-duty oilfield type skid. Theskid frame can be constructed of welded carbon steel coated with a paintsystem suitable for marine service applications. The skid can alsoinclude a stainless steel drip pan with drain valves, and the exposedskid deck can be equipped with fiberglass non-skid grating installedover the skid drip pan.

The BOP surface accumulators can have a working pressure of 5,000 psi,and can be rated to about 6,500 psi or more. The surface volumeaccumulator can be sufficient to allow for closing the annular BOPs, aswell as closing pipe and shearing rams, and completing typical emergencydisconnect operations such as retracting all stabs and unlatching theLMRP connector.

The accumulator bottles can be arranged on manifolds that allow forisolation of a bank of accumulators for maintenance. In addition, themain accumulator system can be designed such that the loss of anindividual accumulator and/or bank cannot result in more than a 25% lossof the total accumulator system capacity. In some embodiments, there canbe an extra single bank of accumulator bottles, which can be used forbank isolation, service repair, and backup for single bottle bankremoval for recertification cycling.

In addition to the above, in some embodiments, each manifold can becomplete with a liquid-filled pressure gauge panel with a block andbleed manifold valve, modified 4-bolt split-flange type ports for theaccumulators, and a single relief valve. Furthermore, the accumulatorbottles can be of a top loading design, which allows bladder removal andmaintenance without removal from the unit. All bottles can be internallycoated with a manufacturer-recommended anti-corrosion coating.

Certain embodiments of the HPU/FRU/Accumulator subsystem 306 includewater filtration. The water filtration system of embodiments of thepresent technology can be modular (skid mounted), and can be tailored tooperate with a vendor's fluid reservoir system. The water filtrationsystem can provide a control that automatically shuts on and off perwater level, and provides an alarm when the flow rate is reduced due toclogged filters or other obstructions.

The water filters of embodiments of the present technology can becapable of being mounted on a skid, can have a 5 horsepower, 460 voltmotor, a stainless steel pump, and a filter controller. In addition, thelevel sensors for controlling the supply side pump can be calibrated sothat the pump turns off before the float closes the valve. Alternately,a pressure sensor can be calibrated to turn off the pump in the eventthat the level sensor fails to turn off the supply side pump.

Yet another component of the HPU/FRU/Accumulator subsystem 306 can be adisinfection unit. In such a disinfection unit, an ultra-violet inlinelight system can be provided for installation in the water supply lineupstream of the FRU unit. The disinfection unit can be designed toreduce organic matter that may be present in the water supply afterpassing through the water filtration skid.

Referring still to FIG. 3A, there is shown the diverter skid/accumulatorsubsystem 308. The diverter control system accumulator can be chargedwith BOP control fluid by the HPU from precharge pressure up to thesystem's operating pressure. The accumulator bottles working pressurecan be about 5,000 psi, and can be rated up to about 6,500 psi or more.The surface volume can allow for closing annular BOP, as well as pipeand/or shearing rams, and completing typical emergency disconnectoperations such as retracting all stabs and unlatching the LMRPconnector.

According to some embodiments, the accumulator bottles can be arrangedon manifolds that allow for isolation of a bank of accumulators formaintenance. Each manifold can be complete with a liquid filled pressuregauge panel with a block and bleed manifold valve, 4-bolt split-flangetype ports for the accumulators, and a single relief valve. In addition,accumulator bottles can be of a top loading design, which allows bladderremoval and maintenance without removal from the unit. All bottles canbe internally coated with a manufacturer-recommended anti-corrosioncoating.

For each of the skids identified herein, including skids for the HPU,FRU, accumulators, etc., the skid base can be complete with liftingeyes, and a stainless steel drip pan with drain port and a shut-offvalve. In addition, the skid frame can be freestanding and constructedof welded carbon steel coated with a paint system suitable for marineservice applications. Stainless steel components can be passivatedand/or electropolished.

Riser Subsystem—FIG. 4

Referring to FIG. 4, there is shown a context diagram depicting internaland external interface connections for the riser subsystem 400.According to an example embodiment, the present technology includes amechanical/hydraulic interface between an RMS and the gimbal/spider thatincorporates 1) hydraulic controls, 2) pressure gauges, 3) valvecontrol, 4) regulator control, and 5) failsafe control/position foroperating the Spider arm position with different drilling systems.

Technology related to that shown and described in FIG. 4 includestechnology shown and described in U.S. Pat. Nos. 7,337,848; 7,331,395;7,975,768; 7,963,336; 8,356,672; 7,913,767; 8,312,933; and 8,322,436,the full disclosures of which are each hereby incorporated herein byreference in their entireties.

As shown in FIG. 4, the riser subsystem includes a surface ERAinstrument module 402, a gas handler system, riser joints 404, atelescopic joint 406, a riser running tool 408, a gimbal 410, a spider412, an adapter ring 414, and a tension ring 416. Each of thesecomponents is described in detail below.

The ERA instrument module 402 provides an inclinometer to monitor the “X& Y” angles of the flex joint for vertical deviation. The assemblytypically attaches to the bottom end (or near) of the riser above theflex joint, with a bracket that bolts on using existing mounting holeson the riser adapter. Whenever the upper portion of the riser deviatesfrom the zero (vertical) reference as it extends from the drillship/vessel, the inclinometer output changes accordingly. These outputscan be filtered and passed to the ship board control system forprocessing and display.

The gas handler system is a specialized annular closing device typicallypositioned below the telescopic joint 406. The gas handler system canadd capabilities to the standard diverter system. When the gas handlersystem receives hydraulic fluid (via a gas handler reel), which acts onthe system to close the internal annular packer, the system's gas ventline then opens. The opening of this gas line allows egress of trappedgas within the wellbore fluid away from the riser and over to the C&Kmanifold located on the rig, where it can be handled as if it were a“kick” being circulated normally from below a closed BOP. Collectively,both systems (the C&K system and the gas handler system) work togetherto safely divert gas “kicks” away from the drill floor of the rig.

The top of the gas handler system is oriented towards the female riserconnector and has six lines. These lines are comprised of two C&K lines,two rigid conduit lines for blue and yellow conduits, one mud boostline, and one gas vent line (this line allows the rising gas to bedeliver to the C&K manifold.

The bottom of the gas handler system can be oriented towards a maleriser connector, and can have up to five lines. These lines can includetwo C&K lines, two rigid conduit lines for blue and yellow conduits, andone mud boost line.

One feature typically included in a gas handler system is the main body,which houses the piston and elastomers providing the gas handler withits sealing ability. As the piston rises, the internal annular packercloses and seals against any shape located inside the riser, or definesan open hole. The riser pipes are typically welded to flanges, which inturn are connected to the gas handler body by stud bolts or otherappropriate fasteners. The auxiliary lines can be stabbed into the body.In some embodiments, hold down plates can be provided around each lineto prevent unstabbing of the periphery lines under high internalpressure. The gas handler system can be rated to handle up to about2,000 psi (137.9 bar) and about 4.5 million pounds tension.

The riser joints 404 can perform three primary functions, including 1)provide for fluid communication between the drilling vessel and the BOPstack and the well (this can be accomplished a) through the main boreduring drilling operation, b) through the C&K lines when the BOP stackis used to control the well, or c) through the auxiliary lines such ashydraulic fluid supply and mud boost lines), 2) guide tools into thewell, and 3) serve as a running and retrieving string for the BOP stack.The riser of the present technology can be rated up to about 4.5 millionpounds of tension, and can consist of a pipe body with a pin coupling onthe lower end and a box coupling on the upper end. Of course, the pinand box ends of the pipe body could be reversed. The couplings can havesupport plates, which provide support for the choke, kill, and auxiliarylines, and which provide a landing shoulder for supporting the weight ofthe riser string on the riser spider during installation or retrievaloperations. Riser joints can be supplied in various lengths up to about90 feet.

Auxiliary lines on the riser joints can be supported by clamping bands,which can be spaced out between the support plates, and fastened aroundthe riser pipe. The lines can be terminated with male or female stabsubs which are held in alignment by the coupling support plate.

In some embodiments of the present technology, the box coupling of eachriser joint 404 can be equipped with dog segments that are driven into agrooved profile on the pin by the movement of a cam ring. This providesa large axial locking force to preload the connection. Cam ring movementis accomplished by the riser spider, discussed in greater detail below.The pin coupling can incorporate an alignment key that mates with a slotin the inside diameter of the box coupling and that can provide about 5degrees of rotational alignment for stabbing the couplings together. Theriser can be fitted with foam buoyancy modules for deep wateroperations.

According to some embodiments, some features of the riser are asfollows:

-   -   The cam ring can be driven to lock or unlock the connection by        the riser spider, so that no subsea hydraulics are needed.    -   High preload connection is developed by the locking dogs.    -   Cam ring detent pins can hold the cam ring in the running        position until the spider engages it. Additionally, the pins can        hold the cam ring in a maintenance position, thereby giving full        access to the dogs for inspection or replacement. The spider        does not move the cam ring to the maintenance position; this is        typically done with a separate tool or manually.    -   Dog segments can be fully retained to the box coupling, and can        include a spring retraction to assist in disconnecting the riser        couplings.    -   Secondary latch can provide back up to the self-locking taper of        the cam ring.    -   Alignment of the coupling and lines can be accomplished by a key        on the pin and slot in the box before engagement of the line        stabs.    -   The running tool profile can be incorporated into the box        coupling.    -   The riser can be fitted with foam buoyancy modules.

The Telescopic Joint 406 is designed to compensate for vertical movementand offset of the drilling vessel. It can also serve as a connectionpoint for the marine riser tensioners (part of the tensioning system418), and a crossover leading to the diverter system 420. In someembodiments, the telescopic joint can consist of five majorsubassemblies, including: 1) the crossover with hydraulic latch, 2) theinner barrel, 3) the dual packer housing, 4) the outer barrel, and 5)the fluid assist bearing. Each of these subassemblies is discussed ingreater detail below.

The crossover assembly can have a standard riser coupling and ahydraulically actuated latch ring. The riser coupling can connect theriser string to the diverter system, and the hydraulic latch ring canlock the inner barrel to the outer barrel for handling, storage, andhangoff. The hydraulic latch ring can consist of six hydraulic cylindersand support dogs plumbed together, that when latched, can support thefull tensile rating of the telescopic joint 406. The crossover can beequipped with a tapered locking nut and special keys to secure andprevent rotation of the mating inner barrel. In some embodiments, thelocking nut can have left hand threads, and can be split to facilitatedisassembly from the inner barrel. The inner barrel can have acentralizing shoe with fluid relief ports at the lower end, to allowcommunication between the wellbore and the inner/outer barrel annulus.

According to some embodiments, the dual packer housing can contain twopressure activated seal elements. Pressure can be applied to each packerthrough ports. An upper seal element can be split, and is generallyactivated with rig air. Such upper seal can provide primary leakagecontrol during normal drilling operations. A lower seal element can beactivated by hydraulic pressure, and provides backup and/or emergencyleakage control. The lower seal element can be solid, and replacementtypically requires the disassembly of the crossover assembly. A topflange can mate with the hydraulic latch dogs when the joint is fullycollapsed. In addition, the top flange can also be equipped withlubrication ports that allow a fluid lubricant to be introduced, whichcan extend the life of the seal elements.

The outer barrel subassembly can have a primary function of providing ameans to apply tension to the marine riser string suspended there below.According to some embodiments, an upper portion of the outer barrel canhave a thick-walled section where the fluid assist bearing is attached.At the very top of the outer barrel can be a flange for attachment ofthe dual packer housing assembly. The lower end of the outer barrel canhave a thick-wall section to prevent collapse should the outer barrelcontact the hull of the vessel.

The fluid assist bearing can contain an annular chamber, which can bepressurized when making vessel heading changes. This reduces thetorsional loads induced into the riser and wellhead from vesselrotation. The rotatable outer housing and fixed stationary piston can besealed using redundant high performance swivel seals.

The hydraulic riser running tool 408 can be a hydraulic tool that ispressure activated with a standard tool joint box/elevator profile up,and a set of locking dogs down. The locking dogs can mate with a profileinside the riser box coupling. The tool can have a fail-safe rising stemdesign that is activated by a hydraulic cylinder to latch or unlatch thetool. The tool can also be equipped with a swiveling lifting padeye nearthe center of gravity, with lift point options and a mechanical lock tokeep the tool locked in position if latch pressure is lost during use.

In some embodiments, the gimbal 410, which can be associated with ashock absorber unit, can provide up to about six degrees of gimbalaction at mid-stroke, by transferring hydraulic fluid from cylinder tocylinder in a closed system. This allows a load suspended from the riserspider to remain stable and independent of pitch and roll of thedrilling vessel within the design limits of the system. The gimbal 410and shock absorber unit greatly reduces the shock loading on the marineriser system when landing the riser in the spider, by gradually reducinglanding velocity and dissipating the energy into the hydraulic systemaccumulators.

The spider 412 can be designed to handle the marine riser joints 404and/or telescopic joint 406 when running or retrieving components of themarine riser subsystem 400. The spider 412 sits on top of the gimbal 410and shock absorber unit, and, for safety and other reasons, can bedesigned to minimize the intervention of rig floor personnel. In manyembodiments, the spider 412 provides three primary functions,including: 1) hang off of the riser string during running or retrieving,2) automated make up and preload of the riser coupling connection, and3) to provide a hang off position for change out of the slip joint upperpacker.

In some embodiments, the spider 412 consists of two sections, includinga lower and an upper section. The lower section typically performs thehang off function by extending six dogs into the bore and hydraulicallylocking them in place. The upper section can utilize six actuation armsto engage the riser cam ring, and lock or unlock the couplings betweenriser sections. According to some embodiments of the present technology,the spider 412 can include one or more of the following features:

-   -   Minimal intervention required by rig personnel. Functions are        operated by the control panel.    -   Six hang off dogs for supporting the riser during running or        retrieving.    -   Hang off dog hydraulic locks to prevent inadvertent retraction        of the hang off dogs.    -   Position indicators of hang off dog position via the hydraulic        locks and indicator bands on the hang off dogs.    -   The lower section can be split into two halves in case of an        emergency via clamping plates.    -   Work platform with grating and safety rails/doors integrated        into the assembly.    -   Six cam actuation arms for automated make up and preload of the        riser coupling. The system can be redundant, and can operate        with a minimum of three arms with an adjustment in the actuation        pressure.    -   Individual arm covers can prevent pinch points, but may be        pivoted upward or removed in order to perform maintenance on the        arm assembly.    -   Control manifold blocks located at the rear of each cam        actuation arm can provide fluid paths, synchronization, and the        ability to remove a single arm from service via a removable        cover/looping plate.

In addition, the spider 412 can be associated with a control system,including:

-   -   A control panel utilizing rig hydraulics for functioning of the        spider via joysticks.    -   A stab plate for makeup of the control system to the spider.    -   A skid for panel movement and storage.    -   Hose bundle assemblies.

According to some embodiments of the technology, the adapter ring 414can interface with the telescopic joint 406 to provide a means to applytension to the deployed marine riser string, while easily connecting anddisconnecting certain marine riser hydraulic functions (e.g., C&K lines,the mud booster line, and/or BOP hydraulic control lines). This can beaccomplished with pressure actuated pin stabs for each hydraulicfunction between the adapter ring 414 and the telescopic joint 406adapter. In some embodiments, the adapter ring 414 allows the rigtensioner lines to remain connected and properly spaced out during riserdeployment and retrieval. In addition, the adapter ring 414 can reduceor eliminate the time associated with attaching and removing thestandard telescopic joint auxiliary line goosenecks. Some embodimentsinclude a fluid assist bearing (FAB) in the adapter ring 414 allows therig to rotate relative to the wellhead without imposing excessive torqueon the riser string. The adapter ring 414 can be designed to attach tothe diverter support housing using stow dogs when not in use.

BOP Stack Subsystem—FIG. 5

FIG. 5 is a contextual diagram depicting the BOP stack subsystem 500,including the LMRP 502 and the lower stack 504. The LMRP 502 can bereleasably connected to the lower stack 504 by a hydraulic connector.Also located at the interface between the LMRP 502 and lower stack 504are components such as wedges, C&K connectors, and electric andhydraulic stabs. These components allow disconnection and thensubsequent reconnection components such as the cables, C&K lines, andelectric and hydraulic lines for circumstances where the LMRP 502 isreleased and removed from the lower stack 504 and then reattached. Sucha scenario may occur, for example, where a hurricane or other conditionsnecessitate temporary removal of the LMRP 502 from the lower stack 504to prevent damage to the system.

According to some embodiments, the BOP stack subsystem can include aframe having lifting eyes 506. The frame can also have two-point liftingcapability, which allows the frame to have the ability to be split intotwo parts. In some embodiments, the entire stack can be retrievable fromeither a horizontal or vertical position, and the frame can have awellhead connector position indicator to provide easy viewing of theconnector operations.

In some embodiments, the BOP stack subsystem has a three-piece framedesign, including a one-piece LMRP and a two-piece lower stack includingupper and lower portions. Various BOPs are attachable to individualrather than multiple levels of the frame, allowing the stack to be splitwithout removing all the BOPs. Additionally, hydraulic manifolds areprovided at each level of the frame; this allows sections of piping tobe readily attached to the manifolds when the frame is assembled,simplifying installation and maintenance operations. The three-piecedesign also facilitates transportation of the BOP stack subsystemcomponents from the site of manufacture to the drill ship or platform.

In some embodiments, the BOP stack subsystem is configurable as a 6, 7,or 8 cavity stack. If desired by the user, the configuration can bemodified in the field after initial deployment. The BOP stack designincludes modular components which allow double BOPs to be exchanged withsingle BOPs and vice versa, depending on the needs of the user.Configurability of the stack enables a user to add or subtract BOPcavities based upon the needs of each wellsite, such as for reasonsrelated to weight, the specific subsea wellhead being used (e.g., 15 ksior 20 ksi), etc. Because the stack is modular and includes strategicallyplaced connections, in order to replace a damaged or worn BOP, a usercan swap a portion of the stack, rather than pulling apart the entirestack, thus reducing down time.

LMRP—FIG. 6

Referring now to FIG. 6, there is shown a context diagram depicting theLMRP 600, including an LMRP frame 604 designed to carry all componentsof the LMRP 600. In some embodiments, the frame can be a fabricatedsteel frame painted with a three part epoxy subsea coating. In addition,the frame can include yoke type hangoff beam supports, and one laddercan be included to provide access to the top of the pedestal. In somecases, the pedestal can include padeyes, which can interface with cranelifting blocks. The frame 604 of the LMRP 600 can be designed to supportthe mounting of acoustic sensors 601 for monitoring the annulars.

According to some embodiments of the technology, the LMRP 600 caninclude many components, including, for example, an ROV interventionpanel, and a C&K subsystem having a C&K flex loop 606, C&K valves 608, agas bleed valve, and C&K stab connectors. In addition, the LMRP 600 caninclude an LMRP connector, a riser adapter 612, the annulars 602, a flexjoint 614, LMRP HPHT probes, and a power and communication hub 616. TheLMRP 600 can further include an LMRP subsea control module 618. Each ofthese features is discussed in greater detail below.

The ROV intervention panel is designed to allow an ROV to performmultiple functions on the LMRP. Typically, such functions are carriedout by an ROV as a backup if the surface controls are not functioningproperly. Through the ROV intervention panel, the ROV can carry out someor all of at least the following functions:

-   -   LMRP connector primary unlock    -   LMRP connector secondary unlock    -   LMRP connector Glycol Flush    -   All stabs retract    -   LMRP gasket retract    -   Inner and outer bleed valves open    -   Riser connector primary and secondary unlock    -   Rigid conduit flush isolation valve    -   Solenoid pilot dump    -   LMRP connector POCV by-pass

The ROC intervention panel can be constructed of stainless steel withROV grab bars, and ROV stabs.

In some embodiments, the C&K subsystem can consist of two independenthydraulic circuits, each substantially similar or identical inconstruction. If identical in construction, either circuit can functionas the “Choke” or “Kill” operation for pumping mud to the well bore orexhausting gas to relieve the pressure in the well bore.

The C&K subsystem can consist of a rigid loop of conduit mounted on theLMRP 600. Valves can be used to isolate the rigid conduit upstream ofthe LMRP/Lower stack interface (Stab Connector). The C&K hydrauliccircuitry can continue on the lower stack, where valves are used toisolate the interfaces to the individual BOPs.

In certain embodiments, the flex loop 606 can be manufactured from pipehaving a 5 inch outer diameter and a 3 1/16 inch inner diameter. Suchpipe can be rated to about 20,000 psi or more. In addition, the C&Kvalves can be designed to be failsafe open, and hydraulically operatedvia subsea control. Some embodiments of the valve have the followingspecifications: minimum 3 1/16 inch with about a 20,000 psi pressurerating, and a flanged end connection with Inconel 625 lined ringgrooves. The valves can be hard pipe, as opposed to flexible hose style,and can be designed and supported to allow full lower flex jointrotation at MWP.

Some embodiments of the technology also include a single gate gas bleedvalve to provide gas relief. This valve can also be operated by thesubsea control subsystem, and can have the following specifications:dual block, hydraulic operated, gas relief, minimum 3 1/16 inch withabout a 20,000 psi pressure rating; a blind pocket target flangeincluded on the end outlet; and ring grooves that are 625 Inconelinlayed.

The C&K stab connector can be hydraulically extendable to the choke orkill line connection between the LMRP 600 and the lower stack. All ofthe hydraulic mechanisms and the seals can be contained in the femalestab connection mounted on the LMRP 600. In some embodiments, the femaleconnector is in the retracted position when the LMRP is landed and matedto the lower stack. According to some embodiments, when the femaleconnector is retracted, there can be a minimum of two inches clearancebetween the bottom end of the female connector and the top of the malestab.

The male stab connection can be mounted near the top of the lower stackframe to align with female stab connection on the LMRP 600. Afterlanding and locking the LMRP 600 to the lower stack, the connection ofthe female stab to the male stab can be made by applying hydraulicpressure to the “extend port” on the female stab connection. With themale/female stab connections engaged, hydraulic pressure is not requiredto maintain the connection. A difference in bore seal diameters providesa bore pressure generated force to maintain the connection.

To disconnect the LMRP 600 from the lower stack, the C&K connector canbe first retracted by applying hydraulic pressure to the “Retract Port”on the female stab connection before disconnecting the LMRP connector.However, should the retract function fail to operate before thedisconnecting the LMRP 600, the C&K Connector does not prevent thedisconnection of the LMRP 600 from the lower stack. In some embodiments,the female stab connection can have a snap ring “detent” to helpmaintain the female stab in the “Extended” or “Retracted” position whenhydraulic pressure or bore pressure is not present.

For some embodiments of the present technology, specifications for thestab connections can be as follows:

-   -   Connector bore size: about 3 1/16-inch (78 mm)    -   Rated working pressure: about 20,000 psi (103.4 MPa)    -   Top Connection: about 3 1/16 inch—about 20,000 psi pressure        rated flange with Inconel 625 ring groove    -   Bottom Connection: about 3 1/16 inch—about 20,000 psi pressure        rated flange with Inconel 625 ring groove    -   Hydrostatic shell test pressure: about 30,000 psi (155.2 MPa)    -   Hydraulic ports: ½-inch diameter    -   Hydraulic working pressure: about 3000 psi (20.7 MPa)    -   Normal operating pressure: about 850A0 psi (10.3 MPa)    -   Hydraulic hydrostatic test pressure: about 4,500 psi (31 MPa)    -   Volume to extend/retract: about 0.52 gal (2 liter)    -   Test port connection: about 9/16 inch autoclave

According to some embodiments of the present technology, the LMRPconnector can have the following specifications:

-   -   Top connection: about 18¾ inches, Inconel 625 overlay ring        groove with a studded top.    -   Added stack height is about 16 inches    -   Overall height with low profile heads is about 44 inches    -   The lower body lead in profile can facilitate up to about 10        degrees offset angle at the BOP mandrel interface.    -   The assembly can be configured with a 30 inch dog kit.

The connector can also have a test port which can allow externalpressure testing of the VX/VT seal, and the VX/VT seal profile andcylinder bores can be overlaid with alloy 625 material.

The riser adapter 612 can consists of a main body with upper and lowerconnections to form a crossover between the marine riser and the LMRP600. The body can support a set of kick-out subs which connect theauxiliary lines on the marine riser to the auxiliary lines/hoses on theLMRP 600. Provisions for the riser instrumentation, such as theinclinometer and slope indicator, and a main bore wear bushing, may beincluded. The entry manifold on the booster line with a gate valve fortesting provides the capability to inject fluids into the riser borethrough the riser adapter 612.

In some embodiments, the riser adapter can include a series of hydrauliccylinders that move a cam ring in order to lock or unlock the connectionwith a series of dog segments. Manual secondary locks can provide backupto the primary lock, and can be rated to the full unlock load of thehydraulic cylinders at 3000 psi. In addition, the hydraulic circuit canincorporate two depth compensation cylinders to prevent a pressuredifferential from occurring within the circuit. Two ball valves can alsobe included for rapid venting of the circuit if required, but remainclosed otherwise. Additional control or ROV panels may be included ifdesired.

The riser adapter 612 can be the termination point for: a mud boosterinlet assembly with an upper “box” stab which incorporates a hydraulicisolation gate value; the gate valve can have a “fail closed” operation,can connect to the riser adapter body through a 90 degree elbow, and the90 degree elbow can mount to the riser adapter body, utilizing a flangemount for the isolation valve. In addition, the riser adapter 612 can bea termination point for 20 k C&K kickouts with about a 3 1/16 inchInconel 625 Inconel lined ring groove flanges, and 5 k Hydraulickickouts with about 2 9/16 inch ring grooves.

The annulars 602 can be a dual annular, hydraulically operated annulartype BOP. In some embodiments, the annular BOP body can contain two setsof 1½″ open and close ports, each equipped with a 4-bolt flange and sealsubs to connect the hydraulic lines. In addition, the annular BOP bodycan also include lift eyes equipped with shackles, each with a safeworking load (SWL) rating of 55 tons per shackle minimum, for liftingthe annular BOP.

Some embodiments of the present technology include one or more LMRP HPHTprobes.

The system can use the LMRP HPHT probes to monitor well bore pressureand temperature. The probes can have an operating range of about0-25,000 psia pressure, −10 to 199 degree C. (14-390 F) temperature. TheHPHT probes can have pressure & temperature accuracy of up to about 0.2%over the full scale. In addition, the probes can have an externalhydrostatic pressure rating of about 12,500 ft. (3,810 M) of waterdepth, and can be connected to the power communications hub on the LMRP600. In some embodiments, the LMRP HPHT probes can be mounted in thechoke line.

In some embodiments, the power and communications hub 616 canencapsulate the functionality of the power distribution and Ethernetbased communication. One advantage of this design is that it helps toprevent the need for any redesign of the BOP control electronics pod inthe event that the power and/or communications needs to be redesign dueto unanticipated demand.

Embodiments of the LMRP subsea control module 618 can control up toabout 130 hydraulically related functions or more. In addition, theelectrical design of the LMRP subsea control module 618 can implement afield bus based I/O to allow expansion. The electrical hardware envelopcan be designed to allow expansion of I/O without modification to thehousing.

The hydraulic pod section of the LMRP subsea control module 618 can beconstructed of corrosion resistant stainless steels. Furthermore,dynamic components can be constructed of corrosion resistantanti-galling stainless steels. In addition, the pod internalsubassemblies can be arranged to provide full access to ensuremaintenance and service efficiency. Furthermore, a manifold can providethe hydraulic connection with the pod male stab and the upper and lowerreceptacles through high-pressure packer seals and retainers. Highpressure fluid can be delivered via the SPM valve transfer spool to theinterface manifold. In turn, the fluid can be distributed to theparticular outlet port via the upper receivers or transferred to thelower receivers via porting in the male stab.

In some embodiments, the pod male stab can be equipped with anextend/retract stainless steel hydraulic cylinder and guide rods. Asafety pin can be included that can secure the pod male stab in theupper position during installation, removal, or handling of the POD offthe stack.

In operation, the pod can receive hydraulic fluid from the rigid conduitmanifold or the hotline. Hydraulic supply to the rigid conduit manifoldin turn can come from the rigid conduit(s) and the stack accumulatorsystem. The lower valve unit manifolds can be mounted in a horizontaltiered array providing easy access to mounted components for service ormaintenance.

In some embodiments, the hydraulic pod section of the LMRP subseacontrol module 618 can include up to five regulated hydraulic controlcircuits or more, which can be mounted in each control pod. Theseregulators can be manufactured from anti-galling and corrosion resistantstainless steel and can be hydraulically piloted. The five regulatorfunctions are: 1) stack connector pressure regulator, 2) upper annularpressure regulator, 3) lower annular pressure regulator, 4) subseamanifold pressure regulator, and 5) ram manifold pressure regulator.

In addition, in some embodiments, modular stainless steel manifolds forregulated and unregulated functions can be provided. The valves can behydraulically connected with formed and welded 316L stainless steel pipespools, with modified split flange hubs containing radial o-ring seals.In addition, the SPM valves can interface to the male stabs via 316Lstainless steel pipe spools containing modified hubs with seal subprofiles. In some embodiments, the hubs can have double radial o-ringseals and 4-bolt forged stainless steel split flanges.

Also included in the LMRP subsea control module is an LMRP disconnectindicator. In some embodiments of the present technology, the LMRPdisconnect indicator can consist of an LMRP disconnect actuator, and anarm operated shear seal valve. Both can be mounted to the lower valveunit of the MUX Pod. When the LMRP 600 is in place on the BOP stack, aspring-loaded pin is in contact with the BOP plate. Upon separation ofthe LMRP 600, the spring-loaded pin extends, causing a hydraulic signalto be transmitted to a pressure transducer and a pressure switch in theMUX Pod. The MUX Pod electronics can then relay the information to thecontrol system that there has been an LMRP disconnect. The pressureswitch can then provide an immediate signal to activate a riser recoilsystem via a dedicated twisted-pair circuit in the MUX cables. In someembodiments, the valve and actuation pin can be constructed ofanti-galling, corrosion resistant stainless steel.

In addition, in some embodiments, the BOP stack vertical orientation “X& Y” angles can be monitored via instrument modules integral to both theBlue and Yellow MUX control pods. The instrumentation, as well as allinterface wiring, can be located internal to the pod SEMs.

Lower Stack—FIGS. 7A, 7B

FIG. 7A is a context diagram of the lower stack 700 of the BOP system ofthe present technology, including a lower stack frame 702, an ROVintervention panel, BOP rams 704, C&K valves 706, and a wellheadconnector 708, and lower stack HPHT probes, a power and communicationshub 710, and a lower subsea control module 712. In addition, the lowerstack 700 can include a guide funnel, to help provide deep waterguidelineless drilling.

The lower stack frame 702 can be designed to carry all components of thelower stack. In some embodiments, the lower stack frame 702 can becomposed of fabricated steel, painted with a three part epoxy subseacoating. In addition, it can be manufactured with yoke type hangoff beamsupports, and can include retractable padeyes that interface with cranelifting blocks. In some embodiments, the lower stack frame 702 can bedesigned to support the mounting of acoustic sensors for monitoring theram BOPs and C&K valves 706.

The ROV intervention panel is designed to allows an ROV to perform thefollowing functions via an access panel mounted to the lower Stack frame702:

-   -   HP upper BSR close    -   HP CSR close    -   HP lower BSR close    -   Middle upper pipe ram close    -   Middle lower pipe ram close    -   Lower choke failsafe open    -   Middle choke failsafe open    -   Upper choke failsafe open    -   Lower kill failsafe open    -   Middle kill failsafe open    -   Upper kill failsafe open    -   Wellhead connector primary unlock    -   Wellhead connector second unlock    -   Wellhead connector glycol flush    -   Wellhead connector gasket retract    -   Autoshear arm

In addition, manual ROV isolation valves can be supplied in the ROVintervention panel for the following:

-   -   ROV by-pass for wellhead connector    -   ROV dump subsea accumulator dump    -   Failsafe accumulators dump isolation valve    -   Subsea accumulators dump isolation valve    -   Each individual subsea accumulator bottle    -   Acoustic supply from subsea accumulator bottles    -   Auto shear/deadman supply from subsea accumulator bottles

In some embodiments, the ROV can have the ability to access and usefluid from the subsea accumulators and/or the 3,000 psi functions on theLMRP or lower stack. Furthermore, the ROV can have the ability torecharge the subsea accumulators.

The lower stack HPHT probes can use a 2-wire device interface to thepower and communications hub 710 on the lower stack 700. In someembodiments, one lower stack HPHT probe can be mounted to an unused porton a ram BOP. A second lower stack HPHT probe can be mounted to anunused port on an alternate ram BOP.

In addition to the above, C&K valves 706 on the lower stack 700 can beused control the C&K applications of individual BOPs on the lower stack700. In some embodiments of the invention, six C&K valves can be used,and the valves can meet the following specifications:

-   -   The valves can be dual block design, hydraulically operated.    -   The valve bores can be about 3 1/16 inch in diameter.    -   The valve flange can be about 4 1/16 inch in diameter.    -   The ring grooves can be 625 inconel inlayed.    -   The valves can be rated for 20,000 psi.    -   Each can contain one blind pocket target flange, included on the        end outlet.    -   The valves can be controlled by the subsea electronics.    -   The valves can be visible to an ROV.    -   The Valves can be rated to handle internal fluid temperature of        up to about 350 degrees Fahrenheit and down to about −20 degrees        Fahrenheit.

The lower stack 700 can also include a wellhead connector 708, which, insome embodiments, can have the following features:

-   -   A top connection having about an 18¾ inch diameter, a pressure        rating of about 20,000 psi, and a studded top with a VX/VT        Inconel ring groove.    -   A bottom connection with a VX/VT Inconel ring groove.    -   Added stack height of about 18 inches.    -   An overall height of about 50⅝ inches with standard cylinder        heads.    -   An Inconel 718 gasket.    -   A 30 inch dog kit.

In some embodiments of the present technology, the wellhead connector708 can be internally ported for hydraulically operated VX/VT retainerpins in four places at 90 degrees, and can have 2 nudge pins at 180degrees integrated into the VX/VT gasket retainer retract circuit. Inaddition, the wellhead connector 708 can allow for external pressuretesting of the VX/VT gasket, and can have a flush out seal to helpprotect against hydrates.

Referring now to FIG. 7B, there is shown a contextual diagram depictingdetails of the lower subsea control module 712. There is included in thelower subsea control module the power and communications hub 710, lowerstack pod receivers, and ROV display 714, an APCS 716, and readbackpressure switches, among other components.

According to certain embodiments of the present technology, the lowersubsea control module 712 accounts for the power and communicationsneeds as applied to the lower stack 700. The design of the lower subseacontrol module 712 (as well as the stabs connecting the LMRP 600 andlower stack 700) accounts for critical and non-critical functionality toensure separate circuitry for both the power and communication.

In some embodiments, lower stack pod receivers provide a hydraulicinterface to the LMRP from the MUX control pod. These receivers can beconstructed of, for example, galling and corrosion resistant stainlesssteels. Corresponding BOP receivers can be spring-loaded, and can bebolted to a welded companion flange on the bottom of the BOP plate. Thereceiver can also provide function ports for the BOP hydrauliccomponents.

Certain embodiments of the technology include an ROV display 714 thatallows an ROV to read and apply power (e.g., if the battery for thedisplay is dead). Under normal operations, each ram position andpressure can be transmitted to the surface for operator display. Thesame information can also be displayed on the ROV display 714, which isreadable by an ROV. In addition, in some embodiments, a battery backupcan be provided to the display in case a loss of power occurs. Thebattery can deliver power to the ROV display 714 for up to about 30 daysor more. In alternate embodiments, the ROV display 714 can provide awetmate connector that can allow the ROV to power the display. In yetother embodiments, the design can provide an illuminated display onlywhen an ROV is present, in order to preserve energy and battery life.

Another feature of the lower subsea control module is the APCS 716. TheAPCS 716 can contain a portable emergency system for shutting in thewell. This is accomplished through the use of sonic signals sent fromthe surface (rig floor, lifeboat, or helicopter) to a subsea acousticcontrol pod that executes critical BOP function commands to shut in thewellhead in the case of the loss of the MUX control system.

The surface and subsurface portions of the APCS 716 communicate viaunique sound signals transmitted and received through transceiversconnected to acoustic transducers. The APCS 716 consists of thefollowing major components: 1) a surface control unit (SCU), 2) a cabledrum and dunking transducer, 3) at least one subseatransceiver/transducer, 4) an acoustic control subsea unit (ACSU), and5) a subsea acoustic pod. In some embodiments, a pod simulator allowsthe operator to test and evaluate the control system for properoperation without using the actual subsea acoustic pod.

In practice, in some embodiments, the subsea transducers receiveacoustic signals generated by the acoustic command unit through adunking transducer. The subsea transducers can be mounted, one each, onhydraulically actuated arms that attach to the stack. With the stack onthe sea bottom, the arms can be extended to horizontal orientations toreceive signals from the surface. The acoustic arms can be of anautomatic extend/retract type, and can be designed with the best line ofsight between the BOP and the rig in a well control situation to ensuregood communication.

The electrical voltages resulting from the subsea signal conversionsactuate solenoid operated valves in the acoustic pod. These actuationsproduce the hydraulic pressures required to shut in the wellhead andother functions. As each actuation occurs, the pod forwards anelectrical confirmation signal for conversion and transmission to theSCUs. Each confirmation signal updates the visual display of pod statusin the SCUs.

Structurally, the subsea acoustic pod can have an upper cylindricalsolenoid housing bolted onto the lower stack hydraulics. The solenoidhousing, frame, external plating and some internal parts of the lowerbox can be made from 316 stainless steel, or any other appropriatematerial. Internal pod components can include solenoid assemblies,pressure switches, a hydraulic filter, an accumulator, and an SPM valvemanifold. The subsea acoustic pod can have an electrical cable interfaceto the Subsea ACS electronic container. The electrical cable interfacecan provide commands to the solenoids, and readback from the pressuretransducers and pressure switches.

In some embodiments, the APCS 716 can allow for up to 12 differentfunctions (including arm/disarm). These functions include:

-   -   HP upper BSR close    -   HP CSR close    -   HP lower BSR close    -   Middle pipe rams close    -   All stabs retract (if required)    -   LMRP connector primary unlock    -   LMRP connector secondary unlock    -   Back-up system arm (autoshear)    -   Lower pipe rams close    -   Acoustic arm    -   Acoustic reset/disarm    -   Wellhead connector lock    -   Acoustic arm—4K supply    -   Acoustic arm—3K supply    -   HP upper BSR close    -   HP CSR close    -   HP lower BSR close    -   Middle pipe rams close    -   All stabs retract (if required)    -   LMRP connector primary unlock    -   LMRP connector secondary unlock    -   Back-up system arm (autoshear)    -   Lower pipe rams close    -   Wellhead connector lock

SIS Subsystem—FIGS. 8A-8C

FIG. 8A shows a system 800 for controlling a subsea BOP 812. The subseaBOP 812 is typically housed in a lower stack 814 positioned on the seafloor 816 below an LMRP 818. The subsea BOP 812 is divided intoindividual BOP rams 813, which can include sealing rams, shear rams,etc. The lower stack 814 and the LMRP 818 can be connected to oneanother by a hydraulic connector 820, which can be controlled to allowdisengagement of the LMRP 818 from the lower stack 814. An upper end 822of the LMRP 818 is connected to a riser 824 that extends from the upperend 822 of the LMRP 818 to a vessel 826 at the surface 828 of the sea.Also included in the system can be a first control pod 830 (oftenreferred to as the yellow control pod) and a second control pod 832(often referred to as the blue control pod). In the embodiment shown inFIG. 8A, the first and second control pods 830, 832 are attached to theLMRP 818. The first control pod 830 and second control pod 832 can becontrolled by first and second control cabinets 831, 833, located on thevessel 826. The vessel 826 can be any appropriate vessel, including, forexample, a drill ship or a platform.

Under normal operations, the subsea BOP rams 813 are hydraulicallycontrolled by the first or second pod 830, 832. Specifically, hydrauliclines 836 run from each of the first and second control pods 830, 832 toindividual rams 813 of the BOP 12. Typically one of the two control pods830, 832 is responsible to hydraulically control the rams 813 throughits respective hydraulic lines 836, while the other control pod 830, 832remains idle. In this way, redundancy is built into the system becauseif the control pod 830, 832 actually controlling the rams 813 becomesincapacitated, or otherwise requires maintenance or replacement, theother control pod 830, 832 can continue operation of the rams 813.

One embodiment of the present technology includes an SIS for controllingthe subsea BOP 812 on a stack wide basis. One purpose of such a systemis to provide the appropriate SIFs to confirm and backup the BOP controlsystem, and comply with certain regulatory standards applicable to manysystems and sub-systems in the petroleum industry. The SIS includes asurface logic solver 838, or logic controller, located at the vessel826, and connected to a first subsea logic solver 840 by a first cable842. The first subsea logic solver 840 is in turn connected to a secondsubsea logic solver 844 by a second cable 846. As shown in FIG. 8A, thesecond subsea logic solver 844 can be connected to a hydraulic controlunit 34 located in the lower stack 814. In some embodiments, the secondsubsea logic solver 844 can be connected to a battery, so that thesecond subsea logic solver 844 can continue to operate after the LMRP818 has been disconnected from the lower stack 814. The surface logicsolver 838 can include an HMI panel 847 to allow an operator tocommunicate with the surface logic solver 838.

In practice, the surface logic solver 838 can generate commands, whichare then transmitted to the first subsea logic solver 840 via the firstcable 842. From the first subsea logic solver 840, the commands are thentransferred to the second subsea logic solver 844, which communicateswith, and may be attached to, the hydraulic control unit 834. Thehydraulic control unit 834 is in turn in communication with the subseaBOP rams 813 via hydraulic lines 836. The second subsea logic solver 844can implement the commands, directing the hydraulic control unit 834 tocontrol the subsea BOP rams 813 as desired by an operator. The logicsolvers 838, 844, 846 of any embodiment described herein can be anyequipment capable of sending and receiving signals according to therequirements of the technology. For example, in some embodiments, thelogic solvers can comprise or include central processing units (CPUs).

In the embodiment shown, each ram 813 can be connected to multiplehydraulic lines 836, each coming from a different control source,including the first control pod 830, the second control pod 832, and thehydraulic control unit 834. As shown, which line controls the BOP ram813 at any given moment can be controlled by valves 839 attached to theBOP rams 813. In the drawings, hydraulic lines 836 are shown connectingeach of the first and second control pods 830, 832 and the hydrauliccontrol unit 834 to some, but not all, of the rams 813. It is to beunderstood that in a functioning system, each of the control componentscan be connected to all of the rams 813, and such a configuration is notshown in the drawing only to improve clarity of the figures.

One benefit of the SIS described above is that it provides additionalredundancy to the system, and acts as a failsafe to enhance safety andreliability of the BOP. Although two control pods 830, 832 are alreadyprovided to create some redundancy in the system, in reality it can bedifficult to use the second control pod 832 if the first control pod 830is out of commission. This is because government regulations and bestpractice procedures dictate that a backup control system always be inplace for the BOP. Thus, if the first control pod 830 is unavailable,the second control pod 832 cannot be used because there would be noredundancy. The SIS herein described helps to alleviate this problem byproviding a second redundant control system.

In addition, the SIS of the present technology can serve to augment thecapabilities of the overall system 812 by providing additional means tocontrol the BOP rams 813, even when both control pods 830, 832 arefunctioning properly. For example, the SIS, via the hydraulic controlunit 834, can control certain rams 813 at the same time that the controlpods 830, 832 are controlling alternate rams 813. Thus, the capacity ofthe system 812 to control the BOP rams 813 is increased. Furthermore,the system can provide monitoring functions, such as monitoring variousstates, statuses, parameters, etc., as well as information to determinewhether the BOP control system is operating properly. The technology canalso be designed to comply with the requirement of high pressuredrilling operations, and can be used, for example, with a 20 Ksi BOPsystem, although it is not limited to such systems, and may be used inother types of systems as well, such as 15 Ksi systems. In addition, theSIS, as described herein, is a different type of control system than theprimary control system, thereby providing the additional advantage ofincreasing the diversity of the control architecture.

Some benefits of the present technology can now be described. In orderto understand the benefits, however, it is first important to understandsome of the requirements of offshore drilling systems, one of which isto allow disconnection and subsequent reconnection of the LMRP 818 fromthe lower stack 814. This can be beneficial, for example, when ahurricane or other storm threatens a drilling vessel or platform. Toweather such a storm, an operator may wish to disconnect the LMRP 818from the lower stack 814, and move the LMRP 818, riser 824 and vessel826 out of harm's way. After the storm passes, it is necessary to thenreconnect the LMRP 818 to the lower stack 814 to resume operations. Thedisconnection and subsequent reconnection of the LMRP 818 to the lowerstack 814 can be greatly simplified by reducing the number ofconnections between these components, and also by controlling the typesof connections made.

One way to simplify the reconnection of the LMRP 818 and the lower stack814 is to provide a pair of subsea logic solvers, as shown in FIG. 8Aand described above. This is because the first cable 842, which connectsthe surface logic solver 838 to the first subsea logic solver 840 mustcarry power and communications between these two components. Often, thedistance between the surface logic solver 838 and the LMRP 818 (and thusthe first subsea logic solver 840) through the riser 824 can be verylong, such as up to about 2 miles in length or more. Thus, power linesin the cable must be relatively high voltage lines, and thecommunications are often carried through optical lines (although copperlines may be used).

If the system were equipped with a single subsea logic solver in thelower stack, an operator would need to disconnect and reconnect bothhigher voltage power lines and fragile optical communications linesbetween the LMRP 818 and the lower stack 814. Such connections could bedangerous (in the case of the high voltage power lines) and coulddegrade the quality of the communication signals (in the case of theoptical communications lines). Alternatively, if the system wereequipped only with a single subsea logic solver on the LMRP 818,multiple hydraulic lines would need to cross from the LMRP 818 to thelower stack 814 to connect to the rams 813. Such a structure could beproblematic because of the need to disconnect and reconnect many morelines between these components.

By providing two separate subsea logic solvers 840, 844, including oneon the LMRP 818 and one on the lower stack 814, these problems can bealleviated. In practice, according to the present technology, the cable842 connecting the surface logic solver 838 to the first subsea logicsolver 840 can include high voltage power lines and opticalcommunication lines. One function of the first subsea logic solver 840can be to convert and lower the voltages, and to convert the opticalsignals to copper, thereby allowing communication between the firstsubsea logic solver 840 and the second subsea logic solver 44 to bethrough low voltage copper wires that make up cable 846. Such lowvoltage copper wire can more easily be disconnected and reconnected asneeded at the interface between the LMRP 818 and the lower stack 814.

In some embodiments of the invention, the hydraulic control unit 834 canbe connected to the hydraulic connector 820 to disconnect or reconnectthe LMRP 818 from the lower stack 814. Since the hydraulic connector 820is attached to the LMRP 818, a single hydraulic line 848 may need tocross the interface between the LMRP 818 and the lower stack 814 toprovide hydraulic communication between the hydraulic control unit 834and the hydraulic connector 820. Alternatively, use of such a line canbe avoided in favor of providing power to the hydraulic connector 820from an accumulator 850 which, in the embodiment shown, can be attachedto the LMRP 818.

For purposes of explanation, the following paragraphs containexplanations of how the SIS can work with other existing BOP systems tooperate specific features of the BOP or other components on the LMRP andlower stack. It is to be understood that these explanations are given byway of example only, and do not represent all of the possible ways thatthat the present technology can be applied in practice.

The first example explains an example of the function of the SIS as itrelates to a pipe ram BOP. The pipe ram function may be initiated by anycontact closure input, or by an HMI panel. The need to close the ram isdetermined by the operator, so the initiation of the function isdetermined by the man-in-the-loop. When the surface logic solver 838 onthe vessel 826 recognizes the input, it may monitor a surface flow meteror subsea sensor. If the BOP is not successfully closed by the BPCS, thesurface logic solver 838 may transmit a signal to the first subsea logicsolver 840. The first subsea logic solver 840 may in turn transmit thesignal to the second subsea logic solver 844, which may fire a functionthat vents the open hydraulic pressure to the pipe ram and applies closepressure to the pipe ram, thus closing the BOP.

The second example explains an example of the function of the SIS as itrelates to a BSR. The BSR function may be initiated by a contact closureinput, or by an HMI panel. The need to close the ram is determined bythe operator, so initiation of the function is determined by theman-in-the-loop. When the surface logic solver 838 on the vessel 826recognizes the input, it may monitor the surface flow meter or subseasensor. If the BOP is not successfully closed by the BPCS, the surfacelogic solver 838 may transmit a signal to the first subsea logic solver840, which may in turn transmit the signal to the second subsea logicsolver 844. The second subsea logic solver 844 may fire a function thatvents the open hydraulic pressure to the BSR and applies close pressureto the BSR, thus closing the BOP.

The third example explains an example of the function of the SIS as itrelates to a CSR BOP. The CSR function may be initiated by a contactclosure input, or by an HMI panel. The need to close the ram isdetermined by the operator, so initiation of the function is determinedby the man-in-the-loop. When the surface logic solver 838 on the vessel826 recognizes the input, it may monitor the surface flow meter orsubsea sensor. If the BOP is not successfully closed by the BPCS, thesurface logic solver 838 may transmit a signal to the first subsea logicsolver 840, which in turn may transmit a signal to the second subsealogic solver 844. The second subsea logic solver 844 may fire a functionthat vents the open hydraulic pressure to the CSR and applies closepressure to the CSR, thus closing the BOP.

The fourth example explains an example of the function of the SIS as itrelates to the hydraulic connector 820. The hydraulic connector 820function may be initiated by a contact closure input, or by an HMIpanel. The need to release the LMRP is determined by the operator, soinitiation of the function is determined by the man-in-the-loop. Whenthe surface logic solver 838 on the vessel 826 recognizes the input, itmay monitor the surface flow meter or subsea sensor. If the hydraulicconnector 820 is not successfully released by the BPCS, the surfacelogic solver 838 may transmit a signal to the first subsea logic solver840, which may in turn transmit a signal to the second subsea logicsolver 844. The second subsea logic solver 844 may fire a function thatvents the latch hydraulic pressure to the hydraulic connector 820 andapplies unlatch pressure to both the primary and secondary unlatchfunctions.

The fifth example explains an example of the function of the SIS as itrelates to an EDS. The EDS function may be initiated by a contactclosure input, or by an HMI panel. The need to disconnect is determinedby the operator, so initiation of the function is determined by theman-in-the-loop. When the surface logic solver 838 on the vessel 826recognizes the input, it may monitor the surface flow meter, or othersensors on the stack, for each function sequentially. If the EDSfunction is not successfully completed by the BPCS, the surface logicsolver 838 may transmit a signal to the first subsea logic solver 840,which in turn may transmit a signal to the second subsea logic solver844. The subsea logic solver may then fire the following, or anothersimilar sequence, of functions:

-   -   Vent the open pressure and apply close pressure to the pipe ram        function    -   Vent the open pressure and apply close pressure to the CSR ram        function    -   Vent the open pressure and apply close pressure to the BSR ram        function    -   Vent the extend pressure and apply the retract pressure to the        stab function    -   Vent the latch pressure and apply primary and secondary unlatch        pressure to the LMRP connector function.

Referring now to FIG. 8B, there is shown an alternate system 810A forcontrolling a subsea BOP 812A. The subsea BOP 812A is typically housedin a lower stack 814A positioned on the sea floor 816A below an LMRP818A. The subsea BOP 812A is divided into individual BOP rams 813A,which can include sealing rams, shear rams, etc. The lower stack 814Aand the LMRP 818A can be connected to one another by a hydraulicconnector 820A, which can be controlled to allow disengagement of theLMRP 818A from the lower stack 814A. An upper end 822A of the LMRP 818Ais connected to a riser 824A that extends from the upper end 822A of theLMRP 818A to a vessel 826A at the surface 828A of the sea. Also includedin the system can be a first control pod 830A (often referred to as theyellow control pod) and a second control pod 832A (often referred to asthe blue control pod), and a hydraulic control unit 834A. In theembodiment shown in FIG. 8B, the first and second control pods 830A,832A are attached to the LMRP 818A. The first control pod 830A andsecond control pod 832A can be controlled by first and second controlcabinets 831A, 833A, located on the vessel 826A. The vessel 826A can beany appropriate vessel, including, for example, a drill ship or aplatform.

Under normal operations, the subsea BOP rams 813A are hydraulicallycontrolled by the first or second pod 830A, 832A. Specifically,hydraulic lines 836A run from each of the first and second control pods830A, 832A to individual rams 813A of the BOP 812A. Typically one of thetwo control pods 830A, 832A is responsible to hydraulically control therams 813A through its respective hydraulic lines 836A, while the othercontrol pod 830A, 832A remains idle. In this way, redundancy is builtinto the system because if the control pod 830A, 832A actuallycontrolling the rams 813A becomes incapacitated, or otherwise requiresmaintenance or replacement, the other control pod 830A, 832A cancontinue operation of the rams 813A.

The embodiment of FIG. 8B is an alternate SIS for controlling the subseaBOP 812A that operates on a pod by pod basis. The SIS includes a surfacelogic solver 838A, or logic controller, located at the vessel 826A, andconnected to a first subsea logic solver 840A by a first cable 842A, anda second subsea logic solver 844A by a second cable 846A. As shown inFIG. 8B, the first subsea logic solver 840A and the second subsea logicsolver 844A can each be connected to an extended I/O extension 851A bycables 849A, which I/O extension 851A is in communication with ahydraulic control unit 834A located in the lower stack 814A. The surfacelogic solver 838A can include HMI panel 847A to allow an operator tocommunicate with the surface logic solver 838A. In one embodiment, theHMI panel 847A can be a panel with push buttons and lit indicators,while other embodiments can include a touch screen display.

In practice, the surface logic solver 838A can generate commands, whichare then transmitted to the first subsea logic solver 840A via the firstcommunications cable 842A, and/or to the second subsea logic solver 844Avia the second cable 846A. From the first subsea logic solver 840Aand/or the second subsea logic solver 844A, the commands are thentransferred to the I/O extension 851A, which communicates with, and maybe attached to, the hydraulic control unit 834A. The hydraulic controlunit 834A is in turn in communication with the subsea BOP rams 813A viahydraulic lines 836A. The I/O extension 851A can implement the commands,directing the hydraulic control unit 834A to control the subsea BOP rams813A as desired by an operator.

In the embodiment shown in FIG. 8B, each ram 813A can be connected tomultiple hydraulic lines 836A, each coming from a different controlsource, including the first control pod 830A, the second control pod832A, and the hydraulic control unit 834A. As shown, which line controlsthe BOP ram 813A at any given moment can be controlled by valves 139attached to the BOP rams 813A. In the drawings, hydraulic lines 836A areshown connecting each of the first and second control pods 830A, 832Aand the hydraulic control unit 834A to some, but not all, of the rams813A. It is to be understood that in a functioning system, each of thecontrol components can be connected to all of the rams 813A, and such aconfiguration is not shown in the drawing only to improve clarity of thefigures.

As discussed in more detail above with respect to the embodiment of FIG.8A, allowing disconnection and subsequent reconnection of the LMRP 818Afrom the lower stack 814A can be very advantageous, such as to providethe ability to move the vessel 826A, riser 824A, and LMRP 818A out ofthe path of a storm. The disconnection and subsequent reconnection ofthe LMRP 18 to the lower stack 814A can be greatly simplified byreducing the number of connections between these components, and also bycontrolling the types of connections made.

One way to simplify the reconnection of the LMRP 818A and the lowerstack 814A is to provide a pair of subsea logic solvers corresponding tothe control pods 830A, 832A, and providing an I/O extension 851A, asshown in FIG. 8B and described above. This is because the first andsecond cables 842A, 846A, which connect the surface logic solver 838A tothe first and second subsea logic solvers 840A, 844A, respectively, mustcarry power and communications between the LMRP 818A and the lower stack814A. Often, the distance between the surface logic solver 838A and theLMRP 818A (and thus the first and second subsea logic solvers 840A,844A) through the riser 824A can be very long, such as up to about 2miles in length or more. Thus, power lines in the cable must be veryhigh voltage lines, and the communications are often carried throughoptical lines.

If the system were equipped with a subsea logic solver in the lowerstack, an operator would need to disconnect and reconnect both highvoltage power lines and fragile optical communications lines between theLMRP 818A and the lower stack 814A. Such connections could be dangerous(in the case of the high voltage power lines) and could degrade thequality of the communication signals (in the case of the opticalcommunications lines). Alternatively, if the system were equipped onlywith single subsea logic solvers on the LMRP 818A, without an I/Oextension near the hydraulic control unit 834A, multiple hydraulic lineswould need to cross from the LMRP 818A to the lower stack 814A toconnect to the rams 813A. Such a structure could be problematic becauseof the need to disconnect and reconnect many more lines between thesecomponents.

By providing subsea logic solvers 840A, 844A on the LMRP 818A and aseparate I/O extension 834A on the lower stack 814A, these problems canbe alleviated. In practice, according to the present technology, thecables 842A, 846A connecting the surface logic solver 838A to the firstand second subsea logic solvers 840A, 846A can include high voltagepower lines and optical communication lines. One function of the firstand second subsea logic solvers 840A, 846A can be to convert and lowerthe voltages, and to convert the optical signals to copper, therebyallowing communication between the first and second subsea logic solvers840A, 846A and the I/O extension 834A to be through low voltage copperwires that make up cables 849A. Such low voltage copper wire can moreeasily be disconnected and reconnected as needed at the interfacebetween the LMRP 818A and the lower stack 814A.

In some embodiments of the invention, the hydraulic control unit 834Acan be connected to the hydraulic connector 820A to disconnect orreconnect the LMRP 818A from the lower stack 814A. Since the hydraulicconnector 820A is attached to the LMRP 818A, a single hydraulic line848A may need to cross the interface between the LMRP 818A and the lowerstack 814A to provide hydraulic communication between the hydrauliccontrol unit 834A and the hydraulic connector 820A. Alternatively, useof such a line can be avoided in favor of providing power to thehydraulic connector 820A from an accumulator 850A which, in theembodiment shown, can be attached to the LMRP 818A.

FIG. 8C shows another aspect of the present technology, including theability to alternate between a man-in-the-loop and an automaticconfiguration for controlling the surface logic solver 838B, and hencethe SIS for controlling a subsea BOP described above. More particularly,the present technology provides a surface logic controller 838B, which,among other things, can monitor the basic processes and controls of theBOP system, including the performance of the subsea logic solvers, theoperation of the BOP rams, the operation of shuttle valves, pressuresensors, temperature sensors, and other components of the subsea system.To monitor the operation of the BOP rams, the surface logic controller838B can monitor the operation of the control pods.

According to the embodiment of FIG. 8C, the surface logic controller canbe equipped with a key switch 852B capable of alternating between aman-in-the-loop state and an automatic state. The key switch can be aphysical switch or can be software code integrated into the code of thelogic solver.

When the key switch 852B is in the man-in-the-loop state, the surfacelogic solver 838B, and hence the SIS for controlling the subsea BOP, canbe controlled by an operator who issues commands to the surface logicsolver 838B through an HMI panel 847B or by other appropriate means.Thus, the operator can have full control over whether to initiate actionusing the SIS or not to initiate action.

Alternatively, when the key switch 852B is in the automatic state, anautomatic controller 854B can used to control the subsea BOP through theSIS described above. The automatic controller can act without promptingby the operator.

Umbilical Subsystem—FIG. 9

FIG. 9 depicts the umbilical subsystem 900 according to one embodimentof the present technology, including cable reels 902, a hotline reel904, and a gas handler reel 906, hose sheaves 910, MUX clamps 912, and agooseneck 914 with gooseneck clamps. Each of the reels can be controlledfrom a control console 908, which can be a remote control console. Thecontrol console can provide for the following positions for eachreel: 1) reel in, 2) brake, and 3) reel out. In addition, in someembodiments, the control console 308 can be provided with filteredregulated air from the ship's air supply.

In some embodiments, the gas handler reel 906 can be designed toaccommodate up to about one thousand feet (1,000 ft) of 2.6 inch outsidediameter hose at 75% capacity, giving the reel a total capacity of 1,333ft of hose. Of course, a different sized reel and/or hose can be used,depending on the needs of a particular operation. The hose can be abundle of two lines encased in a polyurethane jacket, and the hosebundle can have a minimum bend radius of about 15 inches.

The reels can be mounted on a fully seam-welded, carbon steel oilfieldtype skid with overhead headache rack and four point pad eyes for normaloffshore crane handling. The frame can be fabricated from carbon steel,and coated with a three-coat protective coating system. In someembodiments, the gas handler reel 906 (as well as the other reels,discussed below) can have a reel drive system, a level-wind system, ahydraulic swivel designed for specified working pressure, and/or aircontrols to drive the motor. In addition, the reel drive system caninclude a pneumatic operated drive system for both the reel drum andlevel-wind drives, and the brake system.

The level-wind system can be mounted to a removable sub-frame on thereel frame, and can be driven by the rotation of the reel's main shaft.The level-wind system can be pitched and synchronized to the specificsize of the hose. In some embodiments, the level-wind system can consistof an Archimedes or diamond screw, with a traveling carriage supportedby pillow block bearings (with grease fittings), and mounted to asub-frame. The level-wind screw can have an adjustment assembly formanually adjusting the position of the traveling carriage to correctslight deviations in timing with the reel drum. The traveling carriagecan be self-reversing, and can be synchronized with the point ofexit/entry of the hose to the reel drum. The traveling carriage carriesresilient rollers, which control and contain the hose being spooled outfrom the reel.

In certain embodiments, the MUX cable reels 902 can be designed toaccommodate up to about twelve thousand five hundred feet (12,500′) ofarmored MUX cable 916 at eighty-five percent (85%) of spool capacity,thereby giving the reel drum a capacity of approximately sixteenthousand feet (16,000′). Each cable reel 902 can be furnished with about11,500 ft of BOP MUX control cable 916, although the length of the cable916 can vary depending on the well. The cable reels 902 can be designedto allow control from a remote location and provide an override formanual control.

The MUX cable 916 can be constructed using any appropriate wire (suchas, e.g., #7 AWG conductor wire) for power. Single mode optical fiber(Primary and Secondary communication) can be used for Ethernet basedcommunications. In some embodiments, the cable can be constructed withan overall high density polyurethane cover and contra-helical,double-wound armor sheath. There can be two lengths of 11,500 feet ofcable supplied (one designated for the blue spool and one designated forthe yellow spool), each would on a separate reel.

The hose sheaves 910, which can be used, for example, with the MUX cablereels 902 and the hotline reels 904, can be half-moon type sheaves, thatare appropriately sized to the cable/hose outside diameter and minimumbend radius.

According to some embodiments, MUX clamps 912 can be supplied forattaching MUX cable 916/hotline hose and MUX cable 916/gas handler hoseto the riser sections. In addition, a gooseneck assembly, including agooseneck 914 and gooseneck clamps, can be mounted to the riser via athree piece segmented clamp, or by any other appropriate means. In someembodiments, two goosenecks 914 sized to the appropriate bend radius ofthe MUX cable 916 and hotline hose can be installed on the segmentedclamp, in which case both goosenecks 914 can have a double clamp to holda MUX cable 916 and hotline hose. The goosenecks 914 can be mounted viaa double pin hinge arrangement to position the goosenecks 914 in severalpositions as needed.

Test Suite—FIG. 10

There is shown in FIG. 10 a test suite 1000, that includes an HPTU 1002and an ASTS 1004. The HPTU 1002 and ASTS 1004 serve as the primarypieces of test equipment for testing the BOP stack.

The ASTS 1004 can provide the ability to command BOP functionalitythrough the SEM controller 1006. The testing can provide the ability toconfirm the secondary stack is fully functional, and help meet therequirements of government regulators for periodic testing prior todrilling deployment.

In practice, the ASTS 1004 can consist of cabinets that contain testinghardware and software. The ASTS 1004 can be connected to a secondarystack via an umbilical that contains the same hardware connections asthe surface control subsystem. During testing, the ASTS 1004 tracks theusage of all moving components involved in the testing, and, uponcompletion of the testing, the data is transmitted to a centralrepository (big data) for condition monitoring purposes. The data canthen become part of a full life cycle tracking process. A more detailedcontext chart showing the big data system is shown in FIG. 11.

As shown in FIG. 10, the ASTS 1004 can require an additional cabinet1008, such as a SIL rated system cabinet, to test the subsea safetyfeatures, such as the SIS. The cabinet 1008 can house the hardware thatcan provide the same functional interface as the surface control system.

In some embodiments of the present technology, the HPTU 1002 can use acomputer controlled variable speed motor driving a plunger type pump.This design eliminates the need for a secondary high pressure pump.Instead, a triplex plunger pump can be used, driven by a 125 horsepowerelectric motor using non-slip synchronous belts. The motor speed can bevaried using an electronic controller. In some embodiments, there can beup to five pressure ranges tested, including: 1) Low-pressure testing:200-600 psi, 2) Medium-Low-pressure testing 375-1,125 psi, 3)Medium-pressure testing 1,250-3,750 psi, 4) Medium-High-pressure testing3,750-11,250 psi, and 5) High-pressure testing: 12,500-37,500 psi.

The HPTU 1002 can be provided with suitable connections for thepressures involved. In addition, the HPTU 1002 can be supplied withfluid from multiple different sources, including: 1) water from the rigsupply, 2) glycol from the FRU glycol tank, 3) BOP mixed fluid from theFRU mixed tank, and 4) auxiliary supply such as cement unit. In someembodiments, each supply can be equipped with a pneumatically operatedball valve that can be operated remotely from the BOP test/storage arearemote panel or the rig floor remote panel.

The HPTU 1002 can be mounted on a heavy-duty oilfield type skid. In someembodiments, the skid frame can be constructed of welded carbon steel,coated with a paint system suitable for marine service applications. Theskid can include a stainless steel drip pan with drain valves. Theexposed skid deck can be equipped with fiberglass non-skid grating thatis installed over the skid drip pan.

A rig floor console can provide controls for the HPTU 1002 as well astest outputs (defined below) at various pressure ranges. The panel isdesigned for hazardous area installations and provides five differenttest circuits, of differing test pressure ranges, including: 1)Low-pressure testing: 200-600 psi, 2) Medium-Low-pressure testing375-1,125 psi, 3) Medium-pressure testing 1,250-3,750 psi, 4)Medium-High-pressure testing 3,750-11,250 psi, and 5) High-pressuretesting: 12,500-37,500 psi.

The Rig Floor console can also have a port that allows it to receivepressurized fluid from the HPU skid. This fluid can be used to supplythe test system with additional fluid for fast filling up to 5000 psi,increasing the net flow rate capacity of the system.

In addition to the above, an auxiliary distribution manifold can bedesigned to attach to the rig floor remote panel. The auxiliarydistribution manifold can be equipped with four circuits for testing: 1)Output 1 (C&K): 350 psi low pressure and 20,000 psi high pressure, 2)Output 2 (Rigid Conduit): 350 psi low pressure and 5,000 psi highpressure, 3) Output 3 (Mud Boost): 350 psi low pressure and 7,500 psihigh pressure, and 4) Output 4 (Gas Handler/Diverter): 250 psi lowpressure and 2000 psi high pressure.

Certain embodiments of the present technology allow the operator tosimultaneously test different customer circuits at different testconditions. The overall test suite is rated to 20,000 psi. In somecases, a digital means of recording the test data can be provided inplace of a chart recorder. In addition, a digital display can providepressure readings per sampling rate. Furthermore, the rig floor consolejunction box is suitable for hazardous area installations.

Similar to the rig floor console, the BOP test/storage console canprovide controls for the HPTU 1002 as well as test outputs at variouspressure ranges. The panel is designed for hazardous area installationsand provides three different test circuits. As with the rig floorconsole, there are test pressure ranges, including: 1) Low-pressuretesting: 200-600 psi, 2) Medium-Low-pressure testing 375-1,125 psi, 3)Medium-pressure testing 1,250-3,750 psi, 4) Medium-High-pressure testing3,750-11,250 psi, and 5) High-pressure testing: 12,500-37,500 psi.

The BOP test/storage console can also have a port that allows it toreceive pressurized fluid from the HPU skid. This is used to supply thetest system with additional fluid for fast filling up to 5000 psi,increasing the net flow rate capacity of the system. Additionally, itcan provide a regulated test output for testing BOP operators, as wellas for hotlining to BOP stack functions, and pressure testing primaryand secondary BOP.

In some embodiments, the HPTU 1002 is designed to operate as astandalone unit. The panel can include the computer and software forrunning the HPTU system, and it can be designed for safe areainstallation. In addition, the HPTU 1002 can include a variablefrequency drive (VFD), which can be connected to the HPTU motor, andcontrols the motor speed to vary pump flow rates. Furthermore, the HPTU1002 can include a lift bar, for lifting and moving the HPTU skidassembly during installation and maintenance operations

Some embodiments of the test suite 1000 can include retractable teststumps that can be delivered for connection to a wellhead connector witha standard connection. The test stumps can have a nominal size of about18¾ inches, 20 Ksi rated working pressure, with a 30 inch diameter upperpin profile with two differential type 5½ inch full hole tool joint testadapters. The tool joint test adapters can use about a 13½ inch sealdiameter and an integral hydrate test skirt. In addition, the unit canhave the VX/VT profile overlaid with Inconel 625. The lower mandrel bodycan terminate down with about a 35 7/16 inch diameter by 2.0 inch thickstructural plate. The structural plate can have a 12 inch by 1 5/16 inchthru holes on a 31 11/16 inch bolt circle.

Two access holes (external pressure ports) can be provided in the stumpbody to facilitate make-up contact with the high pressure in the topcap. The test and bleed ports can consist of about a 1⅜ inch femaleconnection. A gooseneck tube fitting can be provided that attaches tothe top cap. The overall height can be about 42⅛″. The unit can alsoinclude a pin profile protector.

In addition to the above, the test suite 1000 can include marine risertest caps that can be removable to allow the following testconditions: 1) simultaneous pressure testing of two C&K lines, 2) onemud boost line, and 3) two hydraulic rigid conduits.

As shown in FIGS. 1, 3-7B, and 9-11, each of which depict contextdiagrams of systems and subsystems, the following system interfacesexist in the embodiments of the BOP system shown and described:

-   -   The Ship Board Subsystem supplies data to the Big Data Server.    -   The Ship Board Subsystem supplies electrical power and data to        the Big Data Server.    -   The Ship Board Subsystem sends and receives electrical signals        between the ERA of the Riser Subsystem.    -   The ERA of the Ship Board Subsystem is mechanically installed        onto the Riser Subsystem somewhere below the flex joint of the        Diverter Flex Joint and above the water line.    -   The BOP Stack is mechanically installed to the Riser Subsystem        by means of a flange connection.    -   The Riser Subsystem supplies hydraulics to the BOP Stack. The        rigid conduits supply hydraulic power subsea and the choke,        kill, and mud boost lines supply drilling fluids.    -   The BOP Stack is electrically bonded to the Riser Subsystem        providing continuity between the two subsystems for CP.    -   The subsea components of SIS are mechanically installed on the        BOP Stack.    -   The BOP Stack supplies hydraulic fluid to the SIS which in turn        is used to control the SIL functions on the BOP Stack.    -   The Gooseneck of the Umbilical System is mechanically installed        on the Riser System below the Tension Ring and preferably above        the water line to reduce potential damage to the MUX cables and        hose. MUX Clamps of the Umbilical System are installed on the        Riser Joints to secure the MUX Cables and hoses.    -   The MUX cables and hot line hose of the Umbilical System        mechanically terminate to the BOP Stack.    -   The MUX cables of the Umbilical System supplies electrical power        and communication to the BOP Stack.    -   The MUX cables of the Umbilical System supplies optical        communication to the BOP Stack to send and receive data.    -   The Umbilical System supplies hydraulic control fluid to the BOP        Stack via the hot line hose.    -   Mechanical interface between the Ship Board Subsystem and        Umbilical System.    -   Ship Board Subsystem supplies electrical control and power to        the Umbilical System to transmit to and from the subsea        components.    -   Ship Board Subsystem supplies optical communication to the        Umbilical System to transmit and receive data with the subsea        components.    -   Mechanical interface between the SIS and Umbilical System.    -   The Umbilical System sends electrical power subsea to the SIS.    -   The Umbilical System sends optical control subsea via black        channel communication to the SIS.    -   Mechanical test between the Ship Board Subsystem and BOP Stack.    -   The Ship Board Subsystem provides an electrical signal to the        SIS at the initiation of a function with a safety backup.    -   The Riser Test Cap of the Test Suite can interface with both the        Riser Adapter of the BOP Stack and the Riser Joints of the Riser        Subsystem. This interface can be the same for both components.

In addition, the following external system interfaces have been shownand described:

-   -   The “Big Data Server” can provide an interface (identified for        uploading per satellite connection) to the Drilling Control        Network, to access data collected.    -   The Big Data Servers receive data from the Riser Management        System for the purpose of tracking riser sections usage (time of        deployment subsea and location within the riser string).    -   The Ship Board Subsystem can supply data to the Drilling Control        Network.    -   The Ship Board Subsystem can supply a discrete contact for the        initiation of an automated EDS from the Dynamic Positioning.    -   The Ship Board Subsystem can supply a discrete contact for the        shutdown of the Mud Pumps when the Gas Handler is closed.    -   The Ship Board Subsystem can supply a signal to the Riser Recoil        system when the LMRP is separated from the Lower Stack.    -   Water is supplied to the Ship Board Subsystem from the Rig Water        for the FRU.    -   The Riser Subsystem interfaces to the Spider Automation for        control and readbacks for the Spider.    -   The Riser Subsystem is electrically bonded to the Rig providing        continuity between the two subsystems for CP.    -   The Riser Subsystem can interface mechanically with the RFID        tags provided by the Riser Management System.    -   The Riser Subsystem can be mechanically installed to the        Diverter via the Diverter Flex Joint.    -   Mechanical between the Riser Subsystem and ROV.    -   The Tension Ring of the Riser Subsystem can mechanically        interface with the Tensioning System.    -   The Riser Running Tool of the Riser Subsystem can mechanically        interface with the Riser Running Tool Automation system on the        Rig.    -   The Umbilical System receives hydraulic fluid from the Rig        Piping system.    -   The Umbilical System can be supplied pneumatics for control of        the reels from the Rig Air Supply.    -   The Hose and Cable Sheaves of the Umbilical Subsystem can be        installed mechanically to the Moon Pool Structure on the Rig.    -   The BOP Stack can mechanically lock to the Wellhead via the        Wellhead Connector. The BOP Stack can supply adequate clearance        and Guide Funnel to accommodate installation on to the Wellhead.    -   The Lower Stack of the BOP Stack mechanically interfaces to a        Capping Stack via the mandrel connector. The Lower Stack can        provide enough clearance for the Capping Stack.    -   The BOP Stack can have several interfaces for handling on the        Rig.    -   The BOP Stack can supply appropriate mechanical interface for        ROV intervention, including, but not limited to reaction bars,        ROV operated ball valves, ROV hydraulic stab connections, etc.    -   The BOP Stack can receive hydraulic control from the ROV to        activate functions.    -   The BOP Stack can supply an electrical interface to the ROV to        charge the ROV display.    -   The Test Suite receives hydraulic fluid from the Rig Piping        system.    -   The Test Suite can be supplied pneumatics for control of the        control valves from the Rig Air Supply.    -   The Test Suite can receive power from the Ship Power supply.        Power can be supplied to the Power Management System as well as        the pump motors in the Hydraulic Power Subsystem.    -   Water is supplied to the Test Suite from the Rig Water for the        HPTU and Riser Test Cap.    -   The SIS can have an isolation ball valve that can interface with        the ROV.

SIL Rated System for Blowout Preventer Control Safety InstrumentedSystem for Use on Stack Wide Basis

FIG. 12 shows a system 1210 for controlling a subsea blowout preventer(BOP) 1212. The subsea BOP 1212 is typically housed in a lower stack1214 positioned on the sea floor 1216 below a lower marine riser package(LMRP) 1218. The subsea BOP 1212 is divided into individual BOP rams1213, which can include sealing rams, shear rams, etc. The lower stack1214 and the LMRP 1218 can be connected to one another by a hydraulicconnector 1220, which can be controlled to allow disengagement of theLMRP 1218 from the lower stack 1214. An upper end 1222 of the LMRP 1218is connected to a riser 1224 that extends from the upper end 1222 of theLMRP 1218 to a vessel 1226 at the surface 1228 of the sea. Also includedin the system can be a first control pod 1230 (often referred to as theyellow control pod) and a second control pod 1232 (often referred to asthe blue control pod). In the embodiment shown in FIG. 12, the first andsecond control pods 1230, 1232 are attached to the LMRP 1218. The firstcontrol pod 1230 and second control pod 1232 can be controlled by firstand second control cabinets 1231, 1233, located on the vessel 1226. Thevessel 1226 can be any appropriate vessel, including, for example, adrill ship or a platform.

Under normal operations, the subsea BOP rams 1213 are hydraulicallycontrolled by the first or second pod 1230, 1232. Specifically,hydraulic lines 1236 run from each of the first and second control pods1230, 1232 to individual rams 1213 of the BOP 1212. Typically one of thetwo control pods 1230, 1232 is responsible to hydraulically control therams 1213 through its respective hydraulic lines 1236, while the othercontrol pod 1230, 1232 remains idle. In this way, redundancy is builtinto the system because if the control pod 1230, 1232 actuallycontrolling the rams 1213 becomes incapacitated, or otherwise requiresmaintenance or replacement, the other control pod 1230, 1232 cancontinue operation of the rams 1213.

One embodiment of the present technology includes a safety instrumentedsystem for controlling the subsea BOP 1212 on a stack wide basis. Onepurpose of such a system is to provide the appropriate safetyinstrumented functions to confirm and backup the BOP control system, andcomply with certain regulatory standards applicable to many systems andsub-systems in the petroleum industry. The safety instrumented systemincludes a surface logic solver 1238, or logic controller, located atthe vessel 1226, and connected to a first subsea logic solver 1240 by afirst cable 1242. The first subsea logic solver 1240 is in turnconnected to a second subsea logic solver 1244 by a second cable 1246.As shown in FIG. 12, the second subsea logic solver 1244 can beconnected to a hydraulic control unit 1234 located in the lower stack1214. In some embodiments, the second subsea logic solver 1244 can beconnected to a battery, so that the second subsea logic solver 1244 cancontinue to operate after the LMRP 1218 has been disconnected from thelower stack 1214. The surface logic solver 1238 can include a humanmachine interface (HMI) panel 1247 to allow an operator to communicatewith the surface logic solver 1238.

In practice, the surface logic solver 1238 can generate commands, whichare then transmitted to the first subsea logic solver 1240 via the firstcable 1242. From the first subsea logic solver 1240, the commands arethen transferred to the second subsea logic solver 1244, whichcommunicates with, and may be attached to, the hydraulic control unit1234. The hydraulic control unit 1234 is in turn in communication withthe subsea BOP rams 1213 via hydraulic lines 1236. The second subsealogic solver 1244 can implement the commands, directing the hydrauliccontrol unit 1234 to control the subsea BOP rams 1213 as desired by anoperator. The logic solvers 1238, 1244, 1246 of any embodiment describedherein can be any equipment capable of sending and receiving signalsaccording to the requirements of the technology. For example, in someembodiments, the logic solvers can comprise or include centralprocessing units (CPUs).

In the embodiment shown, each ram 1213 can be connected to multiplehydraulic lines 1236, each coming from a different control source,including the first control pod 1230, the second control pod 1232, andthe hydraulic control unit 1234. As shown, which line controls the BOPram 1213 at any given moment can be controlled by valves 1239 attachedto the BOP rams 1213. In the drawings, hydraulic lines 1236 are shownconnecting each of the first and second control pods 1230, 1232 and thehydraulic control unit 1234 to some, but not all, of the rams 1213. Itis to be understood that in a functioning system, each of the controlcomponents can be connected to all of the rams 1213, and such aconfiguration is not shown in the drawing only to improve clarity of thefigures.

One benefit of the safety instrumented system described above is that itprovides additional redundancy to the system, and acts as a failsafe toenhance safety and reliability of the BOP. Although two control pods1230, 1232 are already provided to create some redundancy in the system,in reality it can be difficult to use the second control pod 1232 if thefirst control pod 1230 is out of commission. This is because governmentregulations and best practice procedures dictate that a backup controlsystem always be in place for the BOP. Thus, if the first control pod1230 is unavailable, the second control pod 1232 cannot be used becausethere would be no redundancy. The safety instrumented system hereindescribed helps to alleviate this problem by providing a secondredundant control system.

In addition, the safety instrumented system of the present technologycan serve to augment the capabilities of the overall system 1212 byproviding additional means to control the BOP rams 1213, even when bothcontrol pods 1230, 1232 are functioning properly. For example, thesafety instrumented system, via the hydraulic control unit 1234, cancontrol certain rams 1213 at the same time that the control pods 1230,1232 are controlling alternate rams 1213. Thus, the capacity of thesystem 1212 to control the BOP rams 1213 is increased. Furthermore, thesystem can provide monitoring functions, such as monitoring variousstates, statuses, parameters, etc., as well as information to determinewhether the BOP control system is operating properly. The technology canalso be designed to comply with the requirement of high pressuredrilling operations, and can be used, for example, with a 20 ksi BOPsystem, although it is not limited to such systems, and may be used inother types of systems as well, such as 15 ksi systems. In addition, thesafety instrumented system, as described herein, is a different type ofcontrol system than the primary control system, thereby providing theadditional advantage of increasing the diversity of the controlarchitecture.

Some benefits of the present technology will now be described. In orderto understand the benefits, however, it is first important to understandsome of the requirements of offshore drilling systems, one of which isto allow disconnection and subsequent reconnection of the LMRP 1218 fromthe lower stack 1214. This can be beneficial, for example, when ahurricane or other storm threatens a drilling vessel or platform. Toweather such a storm, an operator may wish to disconnect the LMRP 1218from the lower stack 1214, and move the LMRP 1218, riser 1224 and vessel1226 out of harm's way. After the storm passes, it is necessary to thenreconnect the LMRP 1218 to the lower stack 1214 to resume operations.The disconnection and subsequent reconnection of the LMRP 1218 to thelower stack 1214 can be greatly simplified by reducing the number ofconnections between these components, and also by controlling the typesof connections made.

One way to simplify the reconnection of the LMRP 1218 and the lowerstack 1214 is to provide a pair of subsea logic solvers, as shown inFIG. 12 and described above. This is because the first cable 1242, whichconnects the surface logic solver 1238 to the first subsea logic solver1240 must carry power and communications between these two components.Often, the distance between the surface logic solver 1238 and the LMRP1218 (and thus the first subsea logic solver 1240) through the riser1224 can be very long, such as up to about 2 miles in length or more.Thus, power lines in the cable must be relatively high voltage lines,and the communications are often carried through optical lines (althoughcopper lines may be used).

If the system were equipped with a single subsea logic solver in thelower stack, an operator would need to disconnect and reconnect bothhigher voltage power lines and fragile optical communications linesbetween the LMRP 1218 and the lower stack 1214. Such connections couldbe dangerous (in the case of the high voltage power lines) and coulddegrade the quality of the communication signals (in the case of theoptical communications lines). Alternatively, if the system wereequipped only with a single subsea logic solver on the LMRP 1218,multiple hydraulic lines would need to cross from the LMRP 1218 to thelower stack 1214 to connect to the rams 1213. Such a structure could beproblematic because of the need to disconnect and reconnect many morelines between these components.

By providing two separate subsea logic solvers 1240, 1244, including oneon the LMRP 1218 and one on the lower stack 1214, these problems can bealleviated. In practice, according to the present technology, the cable1242 connecting the surface logic solver 1238 to the first subsea logicsolver 1240 can include high voltage power lines and opticalcommunication lines. One function of the first subsea logic solver 1240can be to convert and lower the voltages, and to convert the opticalsignals to copper, thereby allowing communication between the firstsubsea logic solver 1240 and the second subsea logic solver 1244 to bethrough low voltage copper wires that make up cable 1246. Such lowvoltage copper wire can more easily be disconnected and reconnected asneeded at the interface between the LMRP 1218 and the lower stack 1214.

In some embodiments of the invention, the hydraulic control unit 1234can be connected to the hydraulic connector 1220 to disconnect orreconnect the LMRP 1218 from the lower stack 1214. Since the hydraulicconnector 1220 is attached to the LMRP 1218, a single hydraulic line1248 may need to cross the interface between the LMRP 1218 and the lowerstack 1214 to provide hydraulic communication between the hydrauliccontrol unit 1234 and the hydraulic connector 1220. Alternatively, useof such a line can be avoided in favor of providing power to thehydraulic connector 1220 from an accumulator 1250 which, in theembodiment shown, can be attached to the LMRP 1218.

For purposes of explanation, the following paragraphs containexplanations of how the safety instrumented system can work with otherexisting BOP systems to operate specific features of the BOP or othercomponents on the LMRP and lower stack. It is to be understood thatthese explanations are given by way of example only, and do notrepresent all of the possible ways that that the present technology canbe applied in practice.

The first example explains an example of the function of the safetyinstrumented system as it relates to a pipe ram BOP. The pipe ramfunction may be initiated by any contact closure input, or by an HMIpanel. The need to close the ram is determined by the operator, so theinitiation of the function is determined by the man-in-the-loop. Whenthe surface logic solver 1238 on the vessel 1226 recognizes the input,it may monitor a surface flow meter. If the BOP is not successfullyclosed by the basic process control system (BPCS), the surface logicsolver 1238 may transmit a signal to the first subsea logic solver 1240.The first subsea logic solver 1240 may in turn transmit the signal tothe second subsea logic solver 1244, which may fire a function thatvents the open hydraulic pressure to the pipe ram and applies closepressure to the pipe ram, thus closing the BOP.

The second example explains an example of the function of the safetyinstrumented system as it relates to a blind shear ram. The blind shearram function may be initiated by a contact closure input, or by an HMIpanel. The need to close the ram is determined by the operator, soinitiation of the function is determined by the man-in-the-loop. Whenthe surface logic solver 1238 on the vessel 1226 recognizes the input,it may monitor the surface flow meter. If the BOP is not successfullyclosed by the BPCS, the surface logic solver 1238 may transmit a signalto the first subsea logic solver 1240, which may in turn transmit thesignal to the second subsea logic solver 1244. The second subsea logicsolver 1244 may fire a function that vents the open hydraulic pressureto the blind shear ram and applies close pressure to the blind shearram, thus closing the BOP.

The third example explains an example of the function of the safetyinstrumented system as it relates to a casing shear ram BOP. The casingshear ram function may be initiated by a contact closure input, or by anHMI panel. The need to close the ram is determined by the operator, soinitiation of the function is determined by the man-in-the-loop. Whenthe surface logic solver 1238 on the vessel 1226 recognizes the input,it may monitor the surface flow meter. If the BOP is not successfullyclosed by the BPCS, the surface logic solver 1238 may transmit a signalto the first subsea logic solver 1240, which in turn may transmit asignal to the second subsea logic solver 1244. The second subsea logicsolver 1244 may fire a function that vents the open hydraulic pressureto the casing shear ram and applies close pressure to the casing shearram, thus closing the BOP.

The fourth example explains an example of the function of the safetyinstrumented system as it relates to the hydraulic connector 1220. Thehydraulic connector 1220 function may be initiated by a contact closureinput, or by an HMI panel. The need to release the LMRP is determined bythe operator, so initiation of the function is determined by theman-in-the-loop. When the surface logic solver 1238 on the vessel 1226recognizes the input, it may monitor the surface flow meter. If thehydraulic connector 1220 is not successfully released by the BPCS, thesurface logic solver 1238 may transmit a signal to the first subsealogic solver 1240, which may in turn transmit a signal to the secondsubsea logic solver 1244. The second subsea logic solver 1244 may fire afunction that vents the latch hydraulic pressure to the hydraulicconnector 1220 and applies unlatch pressure to both the primary andsecondary unlatch functions.

The fifth example explains an example of the function of the safetyinstrumented system as it relates to an emergency disconnect sequence.The EDS function may be initiated by a contact closure input, or by anHMI panel. The need to disconnect is determined by the operator, soinitiation of the function is determined by the man-in-the-loop. Whenthe surface logic solver 1238 on the vessel 1226 recognizes the input,it may monitor the surface flow meter, or other sensors on the stack,for each function sequentially. If the EDS function is not successfullycompleted by the BPCS, the surface logic solver 1238 may transmit asignal to the first subsea logic solver 1240, which in turn may transmita signal to the second subsea logic solver 1244. The subsea logic solvermay then fire the following, or another similar sequence, of functions:

-   -   Vent the open pressure and apply close pressure to the pipe ram        function    -   Vent the open pressure and apply close pressure to the CSR ram        function    -   Vent the open pressure and apply close pressure to the BSR ram        function    -   Vent the extend pressure and apply the retract pressure to the        stab function    -   Vent the latch pressure and apply primary and secondary unlatch        pressure to the LMRP connector function.

Safety Instrumented System for Use on a Pod by Pod Basis

Referring now to FIG. 13, there is shown an alternate system 1310 forcontrolling a subsea blowout preventer (BOP) 1312. The subsea BOP 1312is typically housed in a lower stack 1314 positioned on the sea floor1316 below a lower marine riser package (LMRP) 1318. The subsea BOP 1312is divided into individual BOP rams 1313, which can include sealingrams, shear rams, etc. The lower stack 1314 and the LMRP 1318 can beconnected to one another by a hydraulic connector 1320, which can becontrolled to allow disengagement of the LMRP 1318 from the lower stack1314. An upper end 1322 of the LMRP 1318 is connected to a riser 1324that extends from the upper end 1322 of the LMRP 1318 to a vessel 1326at the surface 1328 of the sea. Also included in the system can be afirst control pod 1330 (often referred to as the yellow control pod) anda second control pod 1332 (often referred to as the blue control pod),and a hydraulic control unit 1334. In the embodiment shown in FIG. 13,the first and second control pods 1330, 1332 are attached to the LMRP1318. The first control pod 1330 and second control pod 1332 can becontrolled by first and second control cabinets 1331, 1333, located onthe vessel 1326. The vessel 1326 can be any appropriate vessel,including, for example, a drill ship or a platform.

Under normal operations, the subsea BOP rams 1313 are hydraulicallycontrolled by the first or second pod 1330, 1332. Specifically,hydraulic lines 1336 run from each of the first and second control pods1330, 1332 to individual rams 1313 of the BOP 1312. Typically one of thetwo control pods 1330, 1332 is responsible to hydraulically control therams 1313 through its respective hydraulic lines 1336, while the othercontrol pod 1330, 1332 remains idle. In this way, redundancy is builtinto the system because if the control pod 1330, 1332 actuallycontrolling the rams 1313 becomes incapacitated, or otherwise requiresmaintenance or replacement, the other control pod 1330, 1332 cancontinue operation of the rams 1313.

The embodiment of FIG. 13 is an alternate safety instrumented system forcontrolling the subsea BOP 1312 that operates on a pod by pod basis. Thesafety instrumented system includes a surface logic solver 1338, orlogic controller, located at the vessel 1326, and connected to a firstsubsea logic solver 1340 by a first cable 1342, and a second subsealogic solver 1344 by a second cable 1346. As shown in FIG. 13, the firstsubsea logic solver 1340 and the second subsea logic solver 1344 caneach be connected to an extended input/output (I/O) extension 1351 bycables 1349, which I/O extension 1351 is in communication with ahydraulic control unit 134 located in the lower stack 1314. The surfacelogic solver 1338 can include HMI panel 1347 to allow an operator tocommunicate with the surface logic solver 1338. In one embodiment, theHMI panel 1347 can be a panel with push buttons and lit indicators,while other embodiments can include a touch screen display.

In practice, the surface logic solver 1338 can generate commands, whichare then transmitted to the first subsea logic solver 1340 via the firstcommunications cable 1342, and/or to the second subsea logic solver 1344via the second cable 1346. From the first subsea logic solver 1340and/or the second subsea logic solver 1344, the commands are thentransferred to the I/O extension 1351, which communicates with, and maybe attached to, the hydraulic control unit 1334. The hydraulic controlunit 1334 is in turn in communication with the subsea BOP rams 1313 viahydraulic lines 1336. The I/O extension 1351 can implement the commands,directing the hydraulic control unit 1334 to control the subsea BOP rams1313 as desired by an operator.

In the embodiment shown in FIG. 13, each ram 1313 can be connected tomultiple hydraulic lines 1336, each coming from a different controlsource, including the first control pod 1330, the second control pod1332, and the hydraulic control unit 1334. As shown, which line controlsthe BOP ram 1313 at any given moment can be controlled by valves 1339attached to the BOP rams 1313. In the drawings, hydraulic lines 1336 areshown connecting each of the first and second control pods 1330, 1332and the hydraulic control unit 1334 to some, but not all, of the rams1313. It is to be understood that in a functioning system, each of thecontrol components can be connected to all of the rams 1313, and such aconfiguration is not shown in the drawing only to improve clarity of thefigures.

As discussed in more detail above with respect to the embodiment of FIG.12, allowing disconnection and subsequent reconnection of the LMRP 1218from the lower stack 1214 can be very advantageous, such as to providethe ability to move the vessel 1326, riser 1324, and LMRP 1318 out ofthe path of a storm. The disconnection and subsequent reconnection ofthe LMRP 1218 to the lower stack 1214 can be greatly simplified byreducing the number of connections between these components, and also bycontrolling the types of connections made.

One way to simplify the reconnection of the LMRP 1318 and the lowerstack 1314 is to provide a pair of subsea logic solvers corresponding tothe control pods 1330, 1332, and providing an I/O extension 1351, asshown in FIG. 13 and described above. This is because the first andsecond cables 1342, 1346, which connect the surface logic solver 1338 tothe first and second subsea logic solvers 1340, 1344, respectively, mustcarry power and communications between the LMRP 1318 and the lower stack1314. Often, the distance between the surface logic solver 1338 and theLMRP 1318 (and thus the first and second subsea logic solvers 1340,1344) through the riser 1324 can be very long, such as up to about 2miles in length or more. Thus, power lines in the cable must be veryhigh voltage lines, and the communications are often carried throughoptical lines.

If the system were equipped with a subsea logic solver in the lowerstack, an operator would need to disconnect and reconnect both highvoltage power lines and fragile optical communications lines between theLMRP 1318 and the lower stack 1314. Such connections could be dangerous(in the case of the high voltage power lines) and could degrade thequality of the communication signals (in the case of the opticalcommunications lines). Alternatively, if the system were equipped onlywith single subsea logic solvers on the LMRP 1318, without an I/Oextension near the hydraulic control unit 1334, multiple hydraulic lineswould need to cross from the LMRP 1318 to the lower stack 1314 toconnect to the rams 1313. Such a structure could be problematic becauseof the need to disconnect and reconnect many more lines between thesecomponents.

By providing subsea logic solvers 1340, 1344 on the LMRP 1318 and aseparate I/O extension 1334 on the lower stack 1314, these problems canbe alleviated. In practice, according to the present technology, thecables 1342, 1346 connecting the surface logic solver 1338 to the firstand second subsea logic solvers 1340, 1346 can include high voltagepower lines and optical communication lines. One function of the firstand second subsea logic solvers 1340, 1346 can be to convert and lowerthe voltages, and to convert the optical signals to copper, therebyallowing communication between the first and second subsea logic solvers1340, 1346 and the I/O extension 1334 to be through low voltage copperwires that make up cables 1349. Such low voltage copper wire can moreeasily be disconnected and reconnected as needed at the interfacebetween the LMRP 1318 and the lower stack 1314.

In some embodiments of the invention, the hydraulic control unit 1334can be connected to the hydraulic connector 1320 to disconnect orreconnect the LMRP 1318 from the lower stack 1314. Since the hydraulicconnector 1320 is attached to the LMRP 1318, a single hydraulic line 148may need to cross the interface between the LMRP 1318 and the lowerstack 1314 to provide hydraulic communication between the hydrauliccontrol unit 1334 and the hydraulic connector 1320. Alternatively, useof such a line can be avoided in favor of providing power to thehydraulic connector 1320 from an accumulator 1350 which, in theembodiment shown, can be attached to the LMRP 1318.

Control System for Safety Instrumented System of Present Technology

FIG. 14 shows another aspect of the present technology, including theability to alternate between a man-in-the-loop and an automaticconfiguration for controlling the surface logic solver 1438, and hencethe safety instrumented systems for controlling a subsea BOP describedabove. More particularly, the present technology provides a surfacelogic controller 1438, which, among other things, can monitor the basicprocesses and controls of the BOP system, including the performance ofthe subsea logic solvers, the operation of the BOP rams, the operationof shuttle valves, pressure sensors, temperature sensors, and othercomponents of the subsea system. To monitor the operation of the BOPrams, the surface logic controller 1438 can monitor the operation of thecontrol pods.

According to the embodiment of FIG. 14, the surface logic controller canbe equipped with a key switch 1452 capable of alternating between aman-in-the-loop state and an automatic state. The key switch can be aphysical switch or can be software code integrated into the code of thelogic solver.

When the key switch 1452 is in the man-in-the-loop state, the surfacelogic solver 1438, and hence the safety instrumented systems forcontrolling the subsea BOP, can be controlled by an operator who issuescommands to the surface logic solver 1438 through an HMI panel 1447 orby other appropriate means. Thus, the operator will have full controlover whether to initiate action using the safety instrumented system ornot to initiate action.

Alternatively, when the key switch 1452 is in the automatic state, anautomatic controller 1454 can used to control the subsea BOP through thesafety instrumented systems described above.

The automatic controller can act without prompting by the operator.

Proof Testing Apparatus and Method for Reducing the Probability ofFailure on Demand of Safety Rated Hydraulic Components

Referring now to FIG. 15, a schematic is shown of a BOP hydraulic drivecircuit with uniquely placed safety valves and manifolds. The hydraulicdrive circuit of FIG. 15 is described in more detail with regard to FIG.16. FIG. 15 shows one example placement of valves that enable theredundancy required to achieve a safety rated system. As notedpreviously, one issue with attaining a safety rating for subseahydraulic equipment is the lack of ability to test each valve in thesystem and ascertain its functionality without retrieving the valvesfrom the sea floor. Advantageously, the present disclosure allows BOPsafety systems to be tested during the period the system is beingpressure tested while it is subsea. Such a solution alleviates theproblem of adding many redundant valves and sensors, and avoidsrequiring the BOP stack to be pulled to the surface for testing on aperiodic basis.

However, FIG. 15 lacks a sufficient number sensors to determine whetherthe valves are operating sufficiently subsea. In the embodiment of FIG.15, one way to fully determine if the valves are all working is to firethe BOP shear rams. One potential problem with the system of FIG. 15 isthat firing a BOP tends to degrade the system and increase the requiredrebuild frequency of the device. One solution to this problem is toleverage the pressure test frequency that already occurs on the rig, asrequired by American Petroleum Institute (API) regulations forhigh-pressure high-temperature (HPHT) equipment.

Referring now to FIG. 16, a schematic is shown of a BOP hydraulic drivecircuit with proof test sensors. In BOP safety system 1600, severalpressure sensors and valves, unique to the embodiments of the presentdisclosure, are utilized to allow proof testing from the surface. FIG.16 largely shows a lower stack portion of a blowout preventer, disposedbeneath a LMRP, or lower marine riser package. A riser connector 1601 isdisposed proximate the LMRP above the lower stack.

Certain example sensors and sensor placements are described as follows.While example sensors will be referred to, such as, for example,pressure gauges and pressure switches, one of ordinary skill in the artwill understand that other suitable gauges, switches, and/or sensorscould be used, such as flow meters, flow detectors, and/or acousticsensors. Moreover, one of ordinary skill in the art will realizealternative placements and combinations of proof sensors are possible ina BOP hydraulic drive circuit. In the embodiments of FIGS. 2 and 3, BPCSsignifies a basic process control system.

BOP safety system 1600 includes a transducer or transmitter 1602 tomeasure characteristics, such as pressures, at an output 1604 of a 3,000psi (3K) regulator 1606 for continuous diagnostics. Transducer ortransmitter 1602, in some embodiments, is a pressure gauge or a pressureswitch. BOP safety system 1600 further includes a transducer ortransmitter 1608 to measure pressures at an output 1610 of a 4,000 psi(4K) regulator 1612 for continuous diagnostics. Transducer ortransmitter 1608, in some embodiments, is a pressure gauge or a pressureswitch. While the regulators discussed in the figures include 3K and 4Kregulators, any other regulators can be used in systems and methods ofthe present disclosure including for example, but not limited to, 1.5K,5K, and/or 7K regulators.

BOP safety system 1600 further includes a transducer or transmitter 1614to measure characteristics, such as the pressure or presence of fluid,in a 4K manifold 1616. Transducer or transmitter 1614, in someembodiments, is a pressure gauge or a pressure switch. Also shown inFIG. 16 is a valve 1618, for example a dump valve, disposed proximate toand in fluid communication with the 4K manifold 1616. Valve 1618 is influid communication with the 4K manifold 1616 to relieve pressure in the4K manifold 1616 during testing methods of the present disclosure,described as follows herein.

In FIG. 16, a BOP 1620 includes BOP upper blind shear ram 1622, BOPcasing shear ram 1624, and BOP lower blind shear ram 1626. BOP upperblind shear ram 1622 is in fluid communication with circuit 1628, BOPcasing shear ram 1624 is in fluid communication with circuit 1630, andBOP lower blind shear ram 1626 is in fluid communication with circuit1632. As shown, each circuit 1628, 1630, 1632 has an open side 1629 anda close side 1631. Sub-plate mounted (SPM) valves 1634, 1636, 1638 areshown on the close side 1631 of the circuits 1628, 1630, 1632. SPMvalves 1640, 1642, 1644 are shown on the open side 1629 of the circuits1628, 1630, 1632. Pressure switches 1646, 1648, 1650 are disposedproximate to and in fluid communication with the open side 1629 of eachcircuit 1628, 1630, 1632 to detect pressure. As mention previously,other sensors in addition to or alternative to pressure switches 1646,1648, 1650 could be used in other embodiments.

Processes for using sensor units, such as for example, units 1602, 1608,1614, 1646, 1648, 1650 in FIG. 16, to determine if valves in BOP safetysystem 1600 are operating properly and safely is one advantage providedby embodiments of the present disclosure. Certain advantageously placedsensor units are used for continuous diagnostics, such as transducers ortransmitters 1602, 1608, and provide the ability of the system to alarmif either of the regulators 1606, 1612 fail.

Referring now to FIG. 17, a sequence diagram is shown for proof testingin an example method, optionally carried out on the BOP hydraulic drivecircuit of FIG. 16. Pressure switches 1646, 1648, 1650 on the open side1629 of circuits 1628, 1630, 1632 are uniquely applied in embodiments ofsubsea testing methods. At a first step 1700 in an example testingmethod exemplified by FIG. 17, pressure on the open side 1629 is dumpedor released by opening one or more valves to test the one or more valveson the open side 1629. As represented by step 1700, an SPM valve can beopened, such as SPM valve 1640. For example, for testing SPM valve 1640on circuit 1628, when the basic process control system has BOP 1620open, including BOP upper blind shear ram 1622, pressure is applied tothe open side 1629 of circuit 1628. To test a safety valve in circuit1628, such as SPM valve 1640, a safety open valve can be operated whilethe BOP 1620 is open.

At step 1702, a pressure switch, such as pressure switch 1646, willtransition from seeing elevated pressure to not seeing elevated pressureafter the pressure is released or dumped at step 1700 by opening SPMvalve 1640, and the pressure switch 1646 will provide feedback that thevalve actually moved from a closed position to an open position. At step1704, the valve, such as SPM valve 1640, can then be returned to itsnormal operational state, which will reapply pressure to the open side1629, also referred to as an open port, of BOP upper blind shear ram1622. This process allows verification that the open side safety valveactually moved, without modifying the valve itself to have additionaldiagnostic equipment and without removing the valve from the BOP safetysystem 1600 or sea floor. This process does not apply any hydraulicclosing pressure to the BOP safety system 1600, so the BOP 1620 itselfdoes not move during the proof test and no wear is caused on the BOP.

Testing a valve set on the close side of a BOP requires an interactionwith a basic process control system. Shearing BOP's in general have lowpressure and high pressure closing circuits. Normally, to close a BOPwhen the system is not shearing, any material low pressure (for exampleabout 1,500 psi) can be applied. The low pressure is used because itreduces the wear on the components and extends the life of the BOP. Whena BOP is closed during a shearing event, the high pressure (for exampleabout 4,000 psi) circuit can be used. High pressure increases the forceon the shearing blades, thereby improving the likelihood that the BOPwill shear (when a pipe is present during operation) and close. Safetysystems, such as BOP safety system 1600, apply only a high pressurecircuit. There is no low pressure circuit included in the design ofsafety systems.

API standards for high-pressure high-temperature (HPHT) equipmentrequire that basic process control systems and BOP's be pressure testedat intervals of 3 weeks or less. One solution for proof testing thesafety systems on BOP's is to integrate the proof test with theAPI-required pressure testing, as described herein. API-required testinguses the basic process control system to close the BOP with a lowpressure close circuit. The BOP, such as BOP 1620, is then pressured up.When the test is complete, the BOP is opened and the system is put backin service. For example, in FIG. 17 at step 1706 the API test beginswhen BOP upper blind shear ram 1622 is closed, and at step 1708 a highpressure test is run according to API standards. At step 1710, the APItest is complete, and further testing according to methods of thepresent disclosure is carried out.

To proof test sub-plate mounted (SPM) valves in the close side of thesafety circuit, the 21 day (3 week) API pressure test is modified asfollows. Here, referring to BOP upper blind shear ram 1622 by example,after the API test, BOP upper blind shear ram 1622 remains closed,having been closed by the low pressure circuit through the basic processcontrol system during step 1706 of the API test. As explained above withregard to steps 1706, 1708, 1710, BOP safety system 1600 is pressuredup, and the test is passed. Afterward at step 1712, BOP safety system1600 begins a test for a manifold fill valve 1652 by opening themanifold fill valve 1652 at step 1714 and uses transducer or transmitter1614, such as, for example a pressure sensor such as a pressure gauge orpressure switch, to confirm the manifold 1616 pressures up to 4K psi atstep 1716. Once the manifold pressures up to 4K psi at step 1716, a testpassed message is displayed at step 1718. In the method exemplified byFIG. 17, method steps can be automated and carried out by a computerreadable medium or carried out by a user. Results can be applied tocarry out subsequent steps and/or can be displayed to a user at thesurface.

In certain embodiments of BOP safety systems, there are three logicsolvers, one on the surface and two sub-sea. A user interface will beprovided on the surface that would allow the user to run safety andtesting processes. Alternatively, the process could be documented in amaintenance manual and the user interface could allow the user controlover individual valves. In both cases, there is some initiation from thesurface to run the test or parts of the test.

At step 1720, a test for a BOP SIL close valve, such as SPM valve 1634begins. At step 1722, the manifold fill valve 1652 is closed by BOPsafety system 1600, and at step 1724, valve 1618, for example a dumpvalve or vent valve, dumps the pressure from the manifold 1616. Thepressure in manifold 1616 drops to about atmospheric pressure. At step1726, a pressure drop in the manifold 1616 is confirmed by transducer ortransmitter 1614, and at step 1728, valve 1618 is returned to a closedstate. At this point in the process the BOP close circuit side ofcircuit 1628 still has about 1,500 psi in the bonnet of BOP upper blindshear ram 1622, and is being held closed by the combination of thispressure and the multi-position lock that is integral to the BOP. Asnoted, the manifold 1616 has been returned to about ambient pressureafter the pressure was dumped at step 1724.

For shearing, BOP's typically contain two blades, which are pushedtogether by two pistons (sometimes referred to as piston operators).Bonnets are housings for the pistons where the hydraulic fluid entersand exits a BOP assembly. In certain embodiments, when a BOP is closed,the control system maintains hydraulic pressure on the close side of thepiston operator(s). However, a mechanical locking mechanism (sometimesreferred to as an “MPL”) is also present to hold the BOP closed in theevent of hydraulic pressure loss.

At step 1730, the safety system opens the SPM valve 1634 on the closeside 1631 of circuit 1628 for BOP upper blind shear ram 1622. Since thebonnet of BOP upper blind shear ram 1622 has 1,500 psi and the manifold1616 is at ambient pressure, opening the SPM valve 1634 will create areverse flow from the BOP upper blind shear ram 1622 bonnet to themanifold 1616. At step 1732, the transducer or transmitter 1614 disposedproximate to and in fluid communication with the manifold 1616 can beused to confirm that the SPM valve 1634 moved by sensing a change inpressure. At step 1734, SPM valve 1634 on the close side 1631 of circuit1628 can then be returned to the operational (closed) state. At step1736, the manifold fill valve 1652 is opened, and the basic processcontrol system can return the BOP upper blind shear ram 1622 to the openposition. This allows the system to return to the drilling mode ofoperation. At step 1738, a pass or fail test message is displayed to auser. One advantage of this methodology over simply driving the bonnetof BOP upper blind shear ram 1622 up to 4K psi to test safety valves isthat the additional stress of the high pressure is never applied to theBOP bonnet extending the life and improving the maintenance cycle.

Proof tests of the present disclosure are enabled, in part, by the MPL.As noted, the bonnet of BOP upper blind shear ram 1622 has 1,500 psi andthe manifold 1616 is at ambient pressure, so opening the SPM valve 1634will create a reverse flow from the BOP upper blind shear ram 1622bonnet to the manifold 1616. Testing a close side valve, such as SPMvalve 1634, intentionally dumps the pressure from the closed side of thebonnet. During that process, the MPL holds the BOP closed untilhydraulic pressure is reapplied to the bonnet.

While the method of FIG. 17 was described largely with regard to FIG. 16and the BOP upper blind shear ram 1622 along with circuit 1628, themethodology can be modified by one of ordinary skill in the art to applybackpressure testing to other systems and other BOP rams, such as, forexample, BOP casing shear ram 1624 and BOP lower blind shear ram 1626.

Moreover, while certain figures and claims recite embodiments of thepresent invention with regard to BOP rams, one of ordinary skill in theart could apply the proof testing algorithm to an annular BOP. The prooftesting algorithm for an annular is slightly modified. As noted above,ram preventers have a multi-position lock (MPL) that keeps them closedwhen the closed side pressure is vented. Annular BOP's do not have thisfeature. Using a manifold of sufficiently small volume compared to thehydraulic chamber volume of an annular BOP, one of ordinary skill canimplement a substantially similar process in an annular. By sizing themanifold with respect to the annular BOP volume, one of ordinary skillcould measure a pressure change in the manifold without risk of ventingall the pressure holding the annular closed.

In the various embodiments of the disclosure described, a person havingordinary skill in the art will recognize that various types of memoryare readable by a computer, such as the memory described in reference tovarious computers and servers, e.g., computer, computer server, webserver, or other computers with embodiments of the present disclosure.

The singular forms “a,” “an,” and “the” include plural referents, unlessthe context clearly dictates otherwise.

Examples of computer-readable medium can include but are not limited to:one or more nonvolatile, hard-coded type media, such as read onlymemories (ROMs), CD-ROMs, and DVD-ROMs, or erasable, electricallyprogrammable read only memories (EEPROMs); recordable type media, suchas floppy disks, hard disk drives, CD-R/RWs, DVD-RAMs, DVD-R/RWs,DVD+R/RWs, flash drives, memory sticks, and other newer types ofmemories; and transmission type media such as digital and analogcommunication links. For example, such media can include operatinginstructions, as well as instructions related to the systems and themethod steps described previously and can operate on a computer. It willbe understood by those skilled in the art that such media can be atother locations instead of, or in addition to, the locations describedto store computer program products, e.g., including software thereon. Itwill be understood by those skilled in the art that the various softwaremodules or electronic components described previously can be implementedand maintained by electronic hardware, software, or a combination of thetwo, and that such embodiments are contemplated by embodiments of thepresent disclosure.

While the present disclosure has been described with respect to alimited number of embodiments, those skilled in the art, having benefitof this disclosure, can appreciate that other embodiments may be devisedwhich do not depart from the scope of the disclosure as describedherein. Accordingly, the scope of the disclosure should be limited onlyby the attached claims.

What is claimed is:
 1. A safety system configured to override a controlmodule arranged to actuate a component of an apparatus for ahydrocarbon-comprising well, the apparatus comprising a lower riserpackage and an emergency disconnect package; the control moduleconfigured to regulate hydraulic fluid to the component, the controlmodule comprising a hydraulic input configured to receive a flow of thehydraulic fluid from a corresponding hydraulic fluid source and ahydraulic output configured to deliver the received hydraulic fluid tothe component; the safety system comprising a trigger input configuredto receive a trigger signal; and at least one valve arranged between (i)the hydraulic input of the control module and the correspondinghydraulic fluid source of the control module, and/or (ii) the hydraulicoutput of the control module and the component, the safety systemconfigured to actuate the at least one valve upon receipt of the triggersignal to control the hydraulic fluid being delivered to the component.2. The safety system of claim 1, wherein when the safety system actuatesthe at least one valve upon receipt of the trigger signal, a vent linein fluid communication with the component is opened to prevent the flowof the hydraulic fluid from being delivered to the component.
 3. Thesafety system of claim 2, wherein when the vent line is opened,hydraulic pressure configured to maintain the component in a first stateis vented.
 4. The safety system of claim 3, wherein upon receipt of thetrigger signal, a second flow of hydraulic fluid is provided to thecomponent.
 5. The safety system of claim 4, wherein the second flow ofhydraulic fluid is configured to apply hydraulic pressure to thecomponent to move the component from the first state to a second state.6. The safety system of claim 1, wherein the safety system is separatedfrom the control module with respect to software and hardware.
 7. Thesafety system of claim 1, wherein the corresponding hydraulic fluidsource comprises an accumulator configured to store and providehydraulic fluid to the control module.
 8. The safety system of claim 1,further comprising an umbilical to transmit power to the safety system9. An apparatus comprising the safety system and control module ofclaim
 1. 10. A safety system configured for use with a control module,and configured to actuate a component of an apparatus for ahydrocarbon-comprising well, the apparatus comprising a lower riserpackage and an emergency disconnect package; the control moduleconfigured to regulate hydraulic fluid to the component, the controlmodule comprising a hydraulic input configured to receive the hydraulicfluid from a corresponding hydraulic fluid source and at least onehydraulic output configured to deliver the received hydraulic fluid tothe component; the safety system comprising: an accumulator configuredto store and provide hydraulic fluid; a trigger input configured toreceive a trigger signal; and at least one pressure valve configured toreceive the stored hydraulic fluid from the accumulator and deliver thestored hydraulic fluid to the component, the safety system configured toopen the at least one pressure valve upon receipt of the trigger signalto deliver the stored hydraulic fluid from the accumulator to thecomponent.
 11. The safety system of claim 10, wherein the safety systemis separated from the control module with respect to software andhardware.
 12. The safety system of claim 10, further comprising at leastone valve between the hydraulic input of the control module and thecorresponding hydraulic fluid source of the control module and/or ahydraulic output of the control module and the component, wherein thesafety system is configured to actuate the at least one valve to open avent line upon receipt of the trigger signal to prevent the hydraulicfluid received from the hydraulic fluid sources from being delivered tothe component.
 13. The safety system of claim 12, wherein when the ventline is opened, hydraulic pressure configured to maintain the componentin a first state is vented.
 14. The safety system of claim 13, whereinthe hydraulic fluid delivered to the component is configured to applyhydraulic pressure to the component to move the component from the firststate to a second state.
 15. The safety system of claim 10, furthercomprising a power management system comprising an umbilical to transmitpower to the safety system.
 16. An apparatus comprising the safetysystem and control module of claim 10.